BUG/MEDIUM: mux-quic: Drain the given amount of data in qcs_http_reset_buf()
Some checks are pending
Contrib / admin/halog/ (push) Waiting to run
Contrib / dev/flags/ (push) Waiting to run
Contrib / dev/haring/ (push) Waiting to run
Contrib / dev/hpack/ (push) Waiting to run
Contrib / dev/poll/ (push) Waiting to run
FreeBSD / clang (push) Waiting to run
VTest / Generate Build Matrix (push) Waiting to run
VTest / (push) Blocked by required conditions
Windows / Windows, gcc, all features (push) Waiting to run

Name of qcs_http_reset_buf() function is confusing. But the comment is
clear. In this function, a given amount of HTX data must be cleared from the
buffer. However, concretely, the whole buffer was always reset. Most of time
it is equivalent but it could be possible to keep unsent data in the
buffer. For instance, when a filter is registered on the data forwarding
stage.

So, instead of calling htx_reset(), htx_drain() must be used.

This patch must be backported to all supported version.
This commit is contained in:
Christopher Faulet 2026-06-24 17:22:29 +02:00
parent 86b664445d
commit 0771f4757e

View file

@ -111,14 +111,15 @@ size_t qcs_http_snd_buf(struct qcs *qcs, struct buffer *buf, size_t count,
size_t qcs_http_reset_buf(struct qcs *qcs, struct buffer *buf, size_t count)
{
struct htx *htx;
struct htx_ret htxret;
TRACE_ENTER(QMUX_EV_STRM_SEND, qcs->qcc->conn, qcs);
htx = htx_from_buf(buf);
htx_reset(htx);
htxret = htx_drain(htx, count);
htx_to_buf(htx, buf);
TRACE_LEAVE(QMUX_EV_STRM_SEND, qcs->qcc->conn, qcs);
return count;
return htxret.ret;
}