From: Willy Tarreau <w@1wt.eu>
Date: Sat, 15 Dec 2018 13:48:31 +0000 (+0100)
Subject: BUG/MEDIUM: mux-h1: make sure we always have at least one HTX block to send
X-Git-Tag: v1.9-dev11~28
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=37dd54d8d459e190c88f18bf8d99a733596fb7df;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h1: make sure we always have at least one HTX block to send

Commit 84cca66 ("BUG/MEDIUM: htx: When performing zero-copy, start from
the right offset.") uncovered another issue which is that the send function
may occasionally be called without any block. It's important to check for
this case when computing the zero-copy offsets.

No backport is needed.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 32004c68c4..09c29c2f02 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -1367,7 +1367,10 @@ static size_t h1_process_output(struct h1c *h1c, struct buffer *buf, size_t coun
 
 	if (!count)
 		goto end;
+
 	chn_htx = htx_from_buf(buf);
+	if (htx_is_empty(chn_htx))
+		goto end;
 
 	if (!h1_get_buf(h1c, &h1c->obuf)) {
 		h1c->flags |= H1C_F_OUT_ALLOC;
@@ -1383,6 +1386,7 @@ static size_t h1_process_output(struct h1c *h1c, struct buffer *buf, size_t coun
 		errflag = H1S_F_REQ_ERROR;
 	}
 
+	/* the htx is non-empty thus has at least one block */
 	blk = htx_get_head_blk(chn_htx);
 
 	tmp = get_trash_chunk();
@@ -1407,7 +1411,7 @@ static size_t h1_process_output(struct h1c *h1c, struct buffer *buf, size_t coun
 		h1c->obuf.head = sizeof(struct htx) + blk->addr;
 
 		if (chn_htx->used == 1 &&
-		    blk && htx_get_blk_type(blk) == HTX_BLK_DATA &&
+		    htx_get_blk_type(blk) == HTX_BLK_DATA &&
 		    htx_get_blk_value(chn_htx, blk).len == count) {
 			void *old_area = h1c->obuf.area;