# HG changeset patch
# User Roman Arutyunyan <arut@nginx.com>
# Date 1642062233 -10800
# Node ID 5acd0d89d8c25f574355ceb86929107cd193b3da
# Parent  47f45a98f892ca22e73b75913de1e5b8b22b8503
QUIC: fixed handling stream input buffers.

Previously, ngx_quic_write_chain() treated each input buffer as a memory
buffer, which is not always the case.  Special buffers were not skipped, which
is especially important when hitting the input byte limit.

The issue manifested itself with ngx_quic_write_chain() returning a non-empty
chain consisting of a special last_buf buffer when called from QUIC stream
send_chain().  In order for this to happen, input byte limit should be equal to
the chain length, and the input chain should end with an empty last_buf buffer.
An easy way to achieve this is the following:

  location /empty {
      return 200;
  }

When this non-empty chain was returned from send_chain(), it signalled to the
caller that input was blocked, while in fact it wasn't.  This prevented HTTP
request from finalization, which prevented QUIC from sending STREAM FIN to
the client.  The QUIC stream was then reset after a timeout.

Now special buffers are skipped and send_chain() returns NULL in the case
above, which signals to the caller a successful operation.

Also, original byte limit is now passed to ngx_quic_write_chain() from
send_chain() instead of actual chain length to make sure it's never zero.

diff --git a/src/event/quic/ngx_event_quic_frames.c b/src/event/quic/ngx_event_quic_frames.c
--- a/src/event/quic/ngx_event_quic_frames.c
+++ b/src/event/quic/ngx_event_quic_frames.c
@@ -527,7 +527,17 @@ ngx_quic_write_chain(ngx_connection_t *c
             continue;
         }
 
-        for (p = b->pos + offset; p != b->last && in && limit; /* void */ ) {
+        for (p = b->pos + offset; p != b->last && in; /* void */ ) {
+
+            if (!ngx_buf_in_memory(in->buf) || in->buf->pos == in->buf->last) {
+                in = in->next;
+                continue;
+            }
+
+            if (limit == 0) {
+                break;
+            }
+
             n = ngx_min(b->last - p, in->buf->last - in->buf->pos);
             n = ngx_min(n, limit);
 
@@ -539,10 +549,6 @@ ngx_quic_write_chain(ngx_connection_t *c
             in->buf->pos += n;
             offset += n;
             limit -= n;
-
-            if (in->buf->pos == in->buf->last) {
-                in = in->next;
-            }
         }
 
         if (b->sync && p == b->last) {
diff --git a/src/event/quic/ngx_event_quic_streams.c b/src/event/quic/ngx_event_quic_streams.c
--- a/src/event/quic/ngx_event_quic_streams.c
+++ b/src/event/quic/ngx_event_quic_streams.c
@@ -861,7 +861,7 @@ ngx_quic_stream_send_chain(ngx_connectio
         }
     }
 
-    in = ngx_quic_write_chain(pc, &qs->out, in, n, 0);
+    in = ngx_quic_write_chain(pc, &qs->out, in, limit, 0);
     if (in == NGX_CHAIN_ERROR) {
         return NGX_CHAIN_ERROR;
     }