BUG/MEDIUM: htx: fix random premature abort of data transfers
It can happen in some cases that the last block of an H2 transfer over
HTX is truncated. This was tracked down to a leftover of an earlier
implementation of htx_xfer_blks() causing the computed size of a block
to be incorrectly calculated if a data block doesn't completely fit into
the target buffer. In practice it causes the EOM block to be attempted to
be emitted with a wrong size and the message to be truncated. One way to
reproduce this is to chain two haproxy instances in h1->h2->h1 with
httpterm as the server and h2load as the client, making many requests
between 8 and 10kB over a single connection. Usually one of the very
first requests will fail.
This fix must be backported to 1.9.
diff --git a/src/htx.c b/src/htx.c
index 892bbd6..de87926 100644
--- a/src/htx.c
+++ b/src/htx.c
@@ -519,8 +519,8 @@
max = htx_free_data_space(dst);
if (max > count)
max = count;
- if (ret + sz > max) {
- sz = max - ret;
+ if (sz > max) {
+ sz = max;
info = (type << 28) + sz;
/* Headers and pseudo headers must be fully copied */
if (type < HTX_BLK_DATA || !sz)