From 3afd85e4b5cbb0c49608b04e06ea7b5ef97b3308 Mon Sep 17 00:00:00 2001 From: Sergey Kandaurov Date: Thu, 25 Dec 2025 01:21:52 +0400 Subject: [PATCH] Output chain: clear the last_buf flag unless inherited. For instance, the last_buf flag is used in the http proxy module when creating HTTP/2 requests to indicate the output is closed. The flag is inherited in ngx_output_chain() to a destination buffer when reading the buffered request body. Then it is used in the proxy output filter to mark the last HTTP/2 DATA frame with END_STREAM. The problem happens when reusing the destination buffer, such as to re-read the buffered request body on next upstream, because this buffer may contain a dirty last_buf value, which breaks sending HTTP/2 request body in multiple output filter calls. The flush and last_in_chain flags are cleared for consistency. --- src/core/ngx_output_chain.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/core/ngx_output_chain.c b/src/core/ngx_output_chain.c index a46209c17..eb467e06a 100644 --- a/src/core/ngx_output_chain.c +++ b/src/core/ngx_output_chain.c @@ -552,6 +552,11 @@ ngx_output_chain_copy_buf(ngx_output_chain_ctx_t *ctx) dst->flush = src->flush; dst->last_buf = src->last_buf; dst->last_in_chain = src->last_in_chain; + + } else { + dst->flush = 0; + dst->last_buf = 0; + dst->last_in_chain = 0; } } else { @@ -648,6 +653,11 @@ ngx_output_chain_copy_buf(ngx_output_chain_ctx_t *ctx) dst->flush = src->flush; dst->last_buf = src->last_buf; dst->last_in_chain = src->last_in_chain; + + } else { + dst->flush = 0; + dst->last_buf = 0; + dst->last_in_chain = 0; } }