# HG changeset patch
# User Roman Arutyunyan <arut@nginx.com>
# Date 1645126722 -10800
# Node ID 55b38514729b8f848709b31295e72d6886a7a433
# Parent  a2fbae3598282f53540313b83a4272269e9aee8e
QUIC: fixed insertion at the end of buffer.

Previously, last buffer was tracked by keeping a pointer to the previous
chain link "next" field.  When the previous buffer was split and then removed,
the pointer was no longer valid.  Writing at this pointer resulted in broken
data chains.

Now last buffer is tracked by keeping a direct pointer to it.

diff --git a/src/event/quic/ngx_event_quic.h b/src/event/quic/ngx_event_quic.h
--- a/src/event/quic/ngx_event_quic.h
+++ b/src/event/quic/ngx_event_quic.h
@@ -53,7 +53,7 @@ typedef struct {
     uint64_t                       offset;
     uint64_t                       last_offset;
     ngx_chain_t                   *chain;
-    ngx_chain_t                  **last_chain;
+    ngx_chain_t                   *last_chain;
 } ngx_quic_buffer_t;
 
 
diff --git a/src/event/quic/ngx_event_quic_frames.c b/src/event/quic/ngx_event_quic_frames.c
--- a/src/event/quic/ngx_event_quic_frames.c
+++ b/src/event/quic/ngx_event_quic_frames.c
@@ -503,7 +503,7 @@ ngx_quic_write_buffer(ngx_connection_t *
 
     if (qb->last_chain && offset >= qb->last_offset) {
         base = qb->last_offset;
-        chain = qb->last_chain;
+        chain = &qb->last_chain;
 
     } else {
         base = qb->offset;
@@ -600,7 +600,7 @@ ngx_quic_write_buffer(ngx_connection_t *
     }
 
     qb->last_offset = base;
-    qb->last_chain = chain;
+    qb->last_chain = *chain;
 
     return in;
 }