[BUG] buffer_replace2 must never change the ->w entry
This function is used to move data which is located between ->w and ->r,
so it must not touch ->w, otherwise it will displace pending data which
is before the one we're actually overwriting. The issue arises with
some pipelined responses which cause some part of the previous one to
be chopped off when removing the connection: close header, thus
corrupting last response and shifting next one. Those are detected
in the logs because the next response will be a 502 with flags PH.
diff --git a/src/buffers.c b/src/buffers.c
index 4f14507..9aa8c3d 100644
--- a/src/buffers.c
+++ b/src/buffers.c
@@ -178,7 +178,7 @@
/*
* this function writes the string <str> at position <pos> which must be in buffer <b>,
* and moves <end> just after the end of <str>.
- * <b>'s parameters (l, r, w, h, lr) are recomputed to be valid after the shift.
+ * <b>'s parameters (l, r, lr) are recomputed to be valid after the shift.
* the shift value (positive or negative) is returned.
* If there's no space left, the move is not done.
* The function does not adjust ->send_max nor BF_OUT_EMPTY because it does not
@@ -196,6 +196,9 @@
if (delta + b->r >= b->data + b->size)
return 0; /* no space left */
+ if (delta + b->r > b->w && b->w >= b->r && b->l)
+ return 0; /* no space left before wrapping data */
+
/* first, protect the end of the buffer */
memmove(end + delta, end, b->r - end);
@@ -204,7 +207,6 @@
/* we only move data after the displaced zone */
if (b->r > pos) b->r += delta;
- if (b->w > pos) b->w += delta;
if (b->lr > pos) b->lr += delta;
b->l += delta;
@@ -230,6 +232,9 @@
if (delta + b->r >= b->data + b->size)
return 0; /* no space left */
+ if (delta + b->r > b->w && b->w >= b->r && b->l)
+ return 0; /* no space left before wrapping data */
+
/* first, protect the end of the buffer */
memmove(end + delta, end, b->r - end);
@@ -239,7 +244,6 @@
/* we only move data after the displaced zone */
if (b->r > pos) b->r += delta;
- if (b->w > pos) b->w += delta;
if (b->lr > pos) b->lr += delta;
b->l += delta;