BUG/MEDIUM: htx: fix random premature abort of data transfers

It can happen in some cases that the last block of an H2 transfer over
HTX is truncated. This was tracked down to a leftover of an earlier
implementation of htx_xfer_blks() causing the computed size of a block
to be incorrectly calculated if a data block doesn't completely fit into
the target buffer. In practice it causes the EOM block to be attempted to
be emitted with a wrong size and the message to be truncated. One way to
reproduce this is to chain two haproxy instances in h1->h2->h1 with
httpterm as the server and h2load as the client, making many requests
between 8 and 10kB over a single connection. Usually one of the very
first requests will fail.

This fix must be backported to 1.9.

diff --git a/src/htx.c b/src/htx.c
index 892bbd6e5f63df51077a0a4e0398b72d720cce21..de879260a78d03ec95cb7d3a3970ee8a9f8b92b8 100644 (file)
--- a/src/htx.c
+++ b/src/htx.c
@@ -519,8 +519,8 @@ struct htx_ret htx_xfer_blks(struct htx *dst, struct htx *src, uint32_t count,
                max = htx_free_data_space(dst);
                if (max > count)
                        max = count;
-               if (ret + sz > max) {
-                       sz = max - ret;
+               if (sz > max) {
+                       sz = max;
                        info = (type << 28) + sz;
                        /* Headers and pseudo headers must be fully copied  */
                        if (type < HTX_BLK_DATA || !sz)