From 27fb6cdb9f7aa9d6258251d565b199e2a15f5286 Mon Sep 17 00:00:00 2001
From: Maxim Dounin <mdounin@mdounin.ru>
Date: Mon, 6 Sep 2021 14:54:47 +0300
Subject: [PATCH] HTTP/2: fixed window updates when buffering in filters.

In the body read handler, the window was incorrectly calculated
based on the full buffer size instead of the amount of free space
in the buffer.  If the request body is buffered by a filter, and
the buffer is not empty after the read event is generated by the
filter to resume request body processing, this could result in
"http2 negative window update" alerts.

Further, in the body ready handler and in ngx_http_v2_state_read_data()
the buffer wasn't cleared when the data were already written to disk,
so the client might stuck without window updates.
---
 src/http/v2/ngx_http_v2.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
index 3d3afaf2d..615f933cf 100644
--- a/src/http/v2/ngx_http_v2.c
+++ b/src/http/v2/ngx_http_v2.c
@@ -1148,10 +1148,18 @@ ngx_http_v2_state_read_data(ngx_http_v2_connection_t *h2c, u_char *pos,
             ngx_http_finalize_request(r, rc);
         }
 
-        if (rc == NGX_AGAIN && !stream->no_flow_control) {
+        if (rc == NGX_AGAIN
+            && !stream->no_flow_control
+            && !r->request_body_no_buffering)
+        {
             buf = r->request_body->buf;
-            window = buf->end - buf->last;
 
+            if (r->request_body->busy == NULL) {
+                buf->pos = buf->start;
+                buf->last = buf->start;
+            }
+
+            window = buf->end - buf->last;
             window -= h2c->state.length - size;
 
             if (window < stream->recv_window) {
@@ -4459,10 +4467,18 @@ ngx_http_v2_read_client_request_body_handler(ngx_http_request_t *r)
         return;
     }
 
+    if (r->request_body->busy != NULL) {
+        return;
+    }
+
     stream = r->stream;
     h2c = stream->connection;
 
     buf = r->request_body->buf;
+
+    buf->pos = buf->start;
+    buf->last = buf->start;
+
     window = buf->end - buf->start;
 
     if (h2c->state.stream == stream) {