BUG/MEDIUM: h3: fix incorrect DATA size block on DEM FULL

The following patch fixes h3_data_to_htx() to ensure the correct value
is returned in case of buffer wrapper.

  bcdbc399d34f82a21c49162f203f2ff16b0aed79
  BUG/MEDIUM: h3: fix end-of-input report on DATA wrapping

However, this introduces a regression when HTX buffer is smaller than
the copied block. In this case, QCS is flagged with QC_SF_DEM_FULL, but
early goto skip the increment on <htx_sent> total value.

This causes corrupted transfers with H3 POST larger than a bufsize
resulting in a larger payload. This is caused by duplicated data blocks
when copy resumes after hitting QC_SF_DEM_FULL condition.

Fix this by ensuring <htx_sent> is always updated before the early goto
path. Intent of the above fix is kept as well as <ret> still serves as a
comparison for QC_SF_DEM_FULL / EOM cases.

This must be backported along the above patch, planned up to 2.6 (after
a period of observation).

diff --git a/src/h3.c b/src/h3.c
index 57b2c00bd0ee0a38829c3ea81a7f624a9fdf0ef6..78655e314a91d2b0a6858ee72d79887425757da6 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -1727,7 +1727,7 @@ static ssize_t h3_data_to_htx(struct qcs *qcs, const struct buffer *buf,
                goto retry;
        }
 
-       ret = htx_add_data(htx, ist2(head, len));
+       htx_sent += ret = htx_add_data(htx, ist2(head, len));
        if (ret < len) {
                qcs->flags |= QC_SF_DEM_FULL;
                goto out;
@@ -1735,7 +1735,6 @@ static ssize_t h3_data_to_htx(struct qcs *qcs, const struct buffer *buf,
 
        if (fin && len == ret)
                htx_set_eom(htx);
-       htx_sent += ret;
 
  out:
        if (appbuf)