BUG/MEDIUM: htx: count the amount of copied data towards the final count

Currently htx_xfer_blks() respects the <count> limit for each block
instead of for the sum of the transfered blocks. This causes it to
return slightly more than requested when both headers and data are
present in the source buffer, which happens early in the transfer
when the reserve is still active. Thus with large enough headers,
the reserve will not be respected.

Note that this function is only called from h2_rcv_buf() thus this only
affects data entering over H2 (H2 requests or H2 responses).

This fix must be backported to 1.9.

diff --git a/src/htx.c b/src/htx.c
index 3e7e4df38435267dcb96d00104eb5b3fd921d017..28374516d8010beebd8b11af93d23f048fbd0722 100644 (file)
--- a/src/htx.c
+++ b/src/htx.c
@@ -482,8 +482,8 @@ struct htx_ret htx_xfer_blks(struct htx *dst, struct htx *src, uint32_t count,
                max = htx_free_data_space(dst);
                if (max > count)
                        max = count;
-               if (sz > max) {
-                       sz = max;
+               if (ret + sz > max) {
+                       sz = max - ret;
                        info = (type << 28) + sz;
                        /* Headers and pseudo headers must be fully copied  */
                        if (type < HTX_BLK_DATA || !sz)