From: Olivier Houchard <ohouchard@haproxy.com>
Date: Wed, 4 Nov 2026 15:14:28 +0000 (+0100)
Subject: BUG/MINOR: haterm: fix the response body phase on short writes
X-Git-Tag: v3.5-dev11~45
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=f7a42a4129211e4f6928a60c78f4bbef253ffdd5;p=haproxy.git

BUG/MINOR: haterm: fix the response body phase on short writes

hstream_add_ff_data() computed the offset of the next body byte as
(req_size - len) % modulo, where <len> is the length offered by the mux
for that call. A short write or a partially filled output buffer makes it
smaller than the number of bytes still to send, so the offset no longer
matched what had already been emitted: the repeating pattern jumped and
the peer received a corrupted body, which happened as soon as a proxy read
the response with its own buffer boundaries. Use hs->to_write instead.

Introduced with ecf36f2ca ("MEDIUM: haterm: Add support for 0-copy data
forwading and option to disable it"), present only in the development
branch, so no backport is needed.
---

diff --git a/src/haterm.c b/src/haterm.c
index 654ab4c47..26eddc1ea 100644
--- a/src/haterm.c
+++ b/src/haterm.c
@@ -563,7 +563,7 @@ static size_t hstream_add_ff_data(struct hstream *hs, struct sedesc *sd, unsigne
 		modulo = HS_COMMON_RESPONSE_LINE_SZ;
 	}
 
-	offset = (hs->req_size - len) % modulo;
+	offset = (hs->req_size - hs->to_write) % modulo;
 	data_ptr = buffer + offset;
 	if (len > (unsigned long long)(buffer_len - offset))
 		len = (unsigned long long)(buffer_len - offset);