From 2bf0c13261924d06317556ed603fb32e41a2d2c5 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Thu, 21 Feb 2019 15:06:30 +0100 Subject: [PATCH] BUG/MEDIUM: htx: count the amount of copied data towards the final count Currently htx_xfer_blks() respects the limit for each block instead of for the sum of the transfered blocks. This causes it to return slightly more than requested when both headers and data are present in the source buffer, which happens early in the transfer when the reserve is still active. Thus with large enough headers, the reserve will not be respected. Note that this function is only called from h2_rcv_buf() thus this only affects data entering over H2 (H2 requests or H2 responses). This fix must be backported to 1.9. --- src/htx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/htx.c b/src/htx.c index 3e7e4df38..28374516d 100644 --- a/src/htx.c +++ b/src/htx.c @@ -482,8 +482,8 @@ struct htx_ret htx_xfer_blks(struct htx *dst, struct htx *src, uint32_t count, max = htx_free_data_space(dst); if (max > count) max = count; - if (sz > max) { - sz = max; + if (ret + sz > max) { + sz = max - ret; info = (type << 28) + sz; /* Headers and pseudo headers must be fully copied */ if (type < HTX_BLK_DATA || !sz)