brbzull0 opened a new pull request, #13629: URL: https://github.com/apache/trafficserver/pull/13629
`Http3FrameDispatcher::on_read_ready()` clones the stream reader per frame and bounds it to that frame: ```c auto cloned_reader = reader.clone(); cloned_reader->size_limit = frame_len; ``` (`src/proxy/http3/Http3FrameDispatcher.cc:112-113`) `Http3StreamDataVIOAdaptor::handle_frame()` then copied the payload with ```c int64_t written = this->_buffer->write(dframe->data()); ``` `MIOBuffer::write` is declared `write(IOBufferReader *r, int64_t len = INT64_MAX, int64_t offset = 0)` (`include/iocore/eventsystem/IOBuffer.h:997`), so with no length it walks the raw block chain and ignores the reader's `size_limit` entirely. Whatever is already buffered behind the DATA frame -- typically the next frame's header and payload -- was copied into the response body. The fix passes `reader->read_avail()`, which clamps to `size_limit` (`src/iocore/eventsystem/IOBuffer.cc:497-499`), so the copy stops at the frame payload. `total_data_length()` is added alongside the existing `has_data() const` so the test can assert on the accumulated body length. ### Test Adds `Http3StreamDataVIOAdaptor bounds the DATA copy` to `test_Http3FrameDispatcher.cc`, and adds `Http3StreamDataVIOAdaptor.cc` to the `test_http3` target so the adaptor is linked in. The test writes two back-to-back DATA frames (`AAAA` then `BBBB`) into one buffer and expects a body of exactly `AAAABBBB`, in two sections: both frames arriving in a single read, and the same bytes arriving one at a time. Confirmed this is a regression test: restoring the unbounded `write(dframe->data())` fails 2 assertions -- `total_data_length() == 8` (`test_Http3FrameDispatcher.cc:448`) and `sink_reader->read_avail() == 8` (`:451`) -- because the second frame's `0x00 0x04` header is pulled into the body. With the fix, `test_http3` passes 155 assertions in 16 cases, up from 134 in 15 on master. Also run: `h3_flow_control`, `h3_stream_lifetime`, `h3_proxy_verifier` autests (3/3 pass; `h3_range_cache` self-skips, the local curl has no http3). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
