From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 24 Jun 2026 15:14:23 +0000 (+0200)
Subject: BUG/MEDIUM: mux-spop: Truly drain outgoing data when the stream is closed
X-Git-Tag: v3.5-dev1~6
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=86b664445d1bff47036d2fe53ca6e908d3d759f3;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-spop: Truly drain outgoing data when the stream is closed

After the H2 and the FCGI multiplexers, it is the third mux concerned by
this issue.

When we try to send data to the server and the stream is closed (in error,
in half-closed state or fully closed), remaining data must be drained. This
way the upper stream is able to properly handle the stream close.

However, there was a bug here. The mux claimed to have consumed these data
without draining them from the buffer. The issue was never reported on the
SPOP multiplexer. But, in theory, the same than for the FCGI multiplexer is
possible.

This patch must be backported as far as 3.2.
---

diff --git a/src/mux_spop.c b/src/mux_spop.c
index 840fa3c9f..3a921ca4e 100644
--- a/src/mux_spop.c
+++ b/src/mux_spop.c
@@ -3427,6 +3427,7 @@ static size_t spop_snd_buf(struct stconn *sc, struct buffer *buf, size_t count,
 
 	if (spop_strm->state >= SPOP_SS_HLOC) {
 		/* trim any possibly pending data after we close */
+		b_del(buf, count);
 		total += count;
 		count = 0;
 	}