BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames
When header are splitted over several frames, payload of HEADERS and
CONTINUATION frames are merged to form a unique HEADERS frame before
decoding the payload. To do so, info about the current frame are updated
(dff, dfl..) with info of the next one. Here there is a bug when the frame
length (dfl) is update. We must add the next frame length (hdr.dfl) and not
only the amount of data found in the buffer (clen). Because HEADERS frames
are decoded in one pass, dfl value is the whole frame length or 0. nothing
intermediary.
This patch must be backported as far as 2.0.
(cherry picked from commit cb1847c77285ba6dbd413774fcf2282cafa19bd2)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 55c007ae42cd210506b0d6e99c13238c4ea49d19)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 081474a3ac01871eafdcfbe59df418d52e1ebd16)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
diff --git a/src/mux_h2.c b/src/mux_h2.c
index bedbcaa..e06319f 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -3705,7 +3705,7 @@
* above). The hole moves after the new aggragated frame.
*/
b_move(&h2c->dbuf, b_peek_ofs(&h2c->dbuf, h2c->dfl + hole + 9), clen, -(h2c->dpl + hole + 9));
- h2c->dfl += clen - h2c->dpl;
+ h2c->dfl += hdr.len - h2c->dpl;
hole += h2c->dpl + 9;
h2c->dpl = 0;
goto next_frame;