From c24c27bb074b571fc9e9d75e19be31b83c69c253 Mon Sep 17 00:00:00 2001 From: Roman Arutyunyan Date: Thu, 17 Feb 2022 22:38:42 +0300 Subject: [PATCH] QUIC: fixed insertion at the end of buffer. Previously, last buffer was tracked by keeping a pointer to the previous chain link "next" field. When the previous buffer was split and then removed, the pointer was no longer valid. Writing at this pointer resulted in broken data chains. Now last buffer is tracked by keeping a direct pointer to it. --- src/event/quic/ngx_event_quic.h | 2 +- src/event/quic/ngx_event_quic_frames.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/event/quic/ngx_event_quic.h b/src/event/quic/ngx_event_quic.h index 109cd54ef..903b690b9 100644 --- a/src/event/quic/ngx_event_quic.h +++ b/src/event/quic/ngx_event_quic.h @@ -53,7 +53,7 @@ typedef struct { uint64_t offset; uint64_t last_offset; ngx_chain_t *chain; - ngx_chain_t **last_chain; + ngx_chain_t *last_chain; } ngx_quic_buffer_t; diff --git a/src/event/quic/ngx_event_quic_frames.c b/src/event/quic/ngx_event_quic_frames.c index 5ffae32c3..9a1a6afe5 100644 --- a/src/event/quic/ngx_event_quic_frames.c +++ b/src/event/quic/ngx_event_quic_frames.c @@ -503,7 +503,7 @@ ngx_quic_write_buffer(ngx_connection_t *c, ngx_quic_buffer_t *qb, if (qb->last_chain && offset >= qb->last_offset) { base = qb->last_offset; - chain = qb->last_chain; + chain = &qb->last_chain; } else { base = qb->offset; @@ -600,7 +600,7 @@ ngx_quic_write_buffer(ngx_connection_t *c, ngx_quic_buffer_t *qb, } qb->last_offset = base; - qb->last_chain = chain; + qb->last_chain = *chain; return in; }