From 84240044f0ecebac489f5b689142a9dfe27ea99d Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Mon, 28 Feb 2022 16:51:23 +0100
Subject: [PATCH] MINOR: channel: don't use co_set_data() to decrement output

The use of co_set_data() should be strictly limited to setting the amount
of existing data to be transmitted. It ought not be used to decrement the
output after the data have left the buffer, because doing so involves
performing incorrect calculations using co_data() that still comprises
data that are not in the buffer anymore. Let's use c_rew() for this, which
is made exactly for this purpose, i.e. decrement c->output by as much as
requested. This is cleaner, faster, and will permit stricter checks.
---
 include/haproxy/channel.h | 2 +-
 src/hlua.c                | 4 ++--
 src/stream_interface.c    | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/haproxy/channel.h b/include/haproxy/channel.h
index 8de8e1758..57e3d9853 100644
--- a/include/haproxy/channel.h
+++ b/include/haproxy/channel.h
@@ -1007,7 +1007,7 @@ static inline int32_t co_htx_remove_blk(struct channel *chn, struct htx *htx, st
 	int32_t size = htx_get_blksz(blk);
 
 	htx_remove_blk(htx, blk);
-	co_set_data(chn, co_data(chn) - size);
+	c_rew(chn, size);
 
 	return size;
 }
diff --git a/src/hlua.c b/src/hlua.c
index 8b42746d8..a69adbd0b 100644
--- a/src/hlua.c
+++ b/src/hlua.c
@@ -4991,7 +4991,7 @@ __LJMP static int hlua_applet_http_getline_yield(lua_State *L, int status, lua_K
 				break;
 		}
 
-		co_set_data(req, co_data(req) - vlen);
+		c_rew(req, vlen);
 		count -= vlen;
 		if (sz == vlen)
 			blk = htx_remove_blk(htx, blk);
@@ -5081,7 +5081,7 @@ __LJMP static int hlua_applet_http_recv_yield(lua_State *L, int status, lua_KCon
 				break;
 		}
 
-		co_set_data(req, co_data(req) - vlen);
+		c_rew(req, vlen);
 		count -= vlen;
 		if (len > 0)
 			len -= vlen;
diff --git a/src/stream_interface.c b/src/stream_interface.c
index ecbd7b06d..4442b2229 100644
--- a/src/stream_interface.c
+++ b/src/stream_interface.c
@@ -792,7 +792,7 @@ int si_cs_send(struct conn_stream *cs)
 		ret = conn->mux->snd_buf(cs, &oc->buf, co_data(oc), send_flag);
 		if (ret > 0) {
 			did_send = 1;
-			co_set_data(oc, co_data(oc) - ret);
+			c_rew(oc, ret);
 			c_realign_if_empty(oc);
 
 			if (!co_data(oc)) {