From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 24 Jun 2026 15:22:29 +0000 (+0200)
Subject: BUG/MEDIUM: mux-quic: Drain the given amount of data in qcs_http_reset_buf()
X-Git-Tag: v3.5-dev1~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0771f4757e3302567724d7e3c2b44e38698bb443;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-quic: Drain the given amount of data in qcs_http_reset_buf()

Name of qcs_http_reset_buf() function is confusing. But the comment is
clear. In this function, a given amount of HTX data must be cleared from the
buffer. However, concretely, the whole buffer was always reset. Most of time
it is equivalent but it could be possible to keep unsent data in the
buffer. For instance, when a filter is registered on the data forwarding
stage.

So, instead of calling htx_reset(), htx_drain() must be used.

This patch must be backported to all supported version.
---

diff --git a/src/qcm_http.c b/src/qcm_http.c
index 962ebc8bc..c2f0ae1eb 100644
--- a/src/qcm_http.c
+++ b/src/qcm_http.c
@@ -111,14 +111,15 @@ size_t qcs_http_snd_buf(struct qcs *qcs, struct buffer *buf, size_t count,
 size_t qcs_http_reset_buf(struct qcs *qcs, struct buffer *buf, size_t count)
 {
 	struct htx *htx;
+	struct htx_ret htxret;
 
 	TRACE_ENTER(QMUX_EV_STRM_SEND, qcs->qcc->conn, qcs);
 
 	htx = htx_from_buf(buf);
-	htx_reset(htx);
+	htxret = htx_drain(htx, count);
 	htx_to_buf(htx, buf);
 
 	TRACE_LEAVE(QMUX_EV_STRM_SEND, qcs->qcc->conn, qcs);
 
-	return count;
+	return htxret.ret;
 }