From: Roman Arutyunyan <arut@nginx.com>
Date: Thu, 17 Feb 2022 19:38:42 +0000 (+0300)
Subject: QUIC: fixed insertion at the end of buffer.
X-Git-Tag: release-1.25.0~4^2~93
X-Git-Url: http://www.kaiwu.me/postgresql/commit/?a=commitdiff_plain;h=c24c27bb074b571fc9e9d75e19be31b83c69c253;p=nginx.git

QUIC: fixed insertion at the end of buffer.

Previously, last buffer was tracked by keeping a pointer to the previous
chain link "next" field.  When the previous buffer was split and then removed,
the pointer was no longer valid.  Writing at this pointer resulted in broken
data chains.

Now last buffer is tracked by keeping a direct pointer to it.
---

diff --git a/src/event/quic/ngx_event_quic.h b/src/event/quic/ngx_event_quic.h
index 109cd54ef..903b690b9 100644
--- a/src/event/quic/ngx_event_quic.h
+++ b/src/event/quic/ngx_event_quic.h
@@ -53,7 +53,7 @@ typedef struct {
     uint64_t                       offset;
     uint64_t                       last_offset;
     ngx_chain_t                   *chain;
-    ngx_chain_t                  **last_chain;
+    ngx_chain_t                   *last_chain;
 } ngx_quic_buffer_t;
 
 
diff --git a/src/event/quic/ngx_event_quic_frames.c b/src/event/quic/ngx_event_quic_frames.c
index 5ffae32c3..9a1a6afe5 100644
--- a/src/event/quic/ngx_event_quic_frames.c
+++ b/src/event/quic/ngx_event_quic_frames.c
@@ -503,7 +503,7 @@ ngx_quic_write_buffer(ngx_connection_t *c, ngx_quic_buffer_t *qb,
 
     if (qb->last_chain && offset >= qb->last_offset) {
         base = qb->last_offset;
-        chain = qb->last_chain;
+        chain = &qb->last_chain;
 
     } else {
         base = qb->offset;
@@ -600,7 +600,7 @@ ngx_quic_write_buffer(ngx_connection_t *c, ngx_quic_buffer_t *qb,
     }
 
     qb->last_offset = base;
-    qb->last_chain = chain;
+    qb->last_chain = *chain;
 
     return in;
 }