From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 24 Jun 2026 14:57:40 +0000 (+0200)
Subject: BUG/MEDIUM: mux-h2: Truly drain outgoing HTX data when the stream is closed
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f19e9c69f2ea35c478c78c460f4b3623d25a2896;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h2: Truly drain outgoing HTX data when the stream is closed

It is the same bug than the previous one on the FCGI mux.

When we try to send data to the server and the stream is closed (in error,
in half-closed state or fully closed), remaining data must be drained. This
way the upper stream is able to properly handle the stream close.

However, there was a bug here. The mux claimed to have consumed these data
without draining them from the buffer. The issue was never reported on the
H2 multiplexer. But, in theory, the same than for the FCGI multiplexer is
possible.

Tihs patch must be backported to all supported versions.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 8897ee373..50656eb44 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -8186,11 +8186,14 @@ static size_t h2_snd_buf(struct stconn *sc, struct buffer *buf, size_t count, in
 
   done:
 	if (h2s->st >= H2_SS_HLOC) {
+		struct htx_ret htxret;
+
 		/* trim any possibly pending data after we close (extra CR-LF,
 		 * unprocessed trailers, abnormal extra data, ...)
 		 */
-		total += count;
-		count = 0;
+		htxret = htx_drain(htx, count);
+		total += htxret.ret;
+		count -= htxret.ret;
 	}
 
 	/* RST are sent similarly to frame acks */