From: Sergey Kandaurov <pluknet@nginx.com>
Date: Wed, 24 Dec 2025 21:21:52 +0000 (+0400)
Subject: Output chain: clear the last_buf flag unless inherited.
X-Git-Tag: release-1.29.5~4
X-Git-Url: http://www.kaiwu.me/postgresql/commit/static/gitweb.js?a=commitdiff_plain;h=3afd85e4b5cbb0c49608b04e06ea7b5ef97b3308;p=nginx.git

Output chain: clear the last_buf flag unless inherited.

For instance, the last_buf flag is used in the http proxy module when
creating HTTP/2 requests to indicate the output is closed.  The flag
is inherited in ngx_output_chain() to a destination buffer when reading
the buffered request body.  Then it is used in the proxy output filter
to mark the last HTTP/2 DATA frame with END_STREAM.

The problem happens when reusing the destination buffer, such as to
re-read the buffered request body on next upstream, because this buffer
may contain a dirty last_buf value, which breaks sending HTTP/2 request
body in multiple output filter calls.

The flush and last_in_chain flags are cleared for consistency.
---

diff --git a/src/core/ngx_output_chain.c b/src/core/ngx_output_chain.c
index a46209c17..eb467e06a 100644
--- a/src/core/ngx_output_chain.c
+++ b/src/core/ngx_output_chain.c
@@ -552,6 +552,11 @@ ngx_output_chain_copy_buf(ngx_output_chain_ctx_t *ctx)
             dst->flush = src->flush;
             dst->last_buf = src->last_buf;
             dst->last_in_chain = src->last_in_chain;
+
+        } else {
+            dst->flush = 0;
+            dst->last_buf = 0;
+            dst->last_in_chain = 0;
         }
 
     } else {
@@ -648,6 +653,11 @@ ngx_output_chain_copy_buf(ngx_output_chain_ctx_t *ctx)
             dst->flush = src->flush;
             dst->last_buf = src->last_buf;
             dst->last_in_chain = src->last_in_chain;
+
+        } else {
+            dst->flush = 0;
+            dst->last_buf = 0;
+            dst->last_in_chain = 0;
         }
     }