From d3d6c5e314fc6fab030678f29c697b9899b4135d Mon Sep 17 00:00:00 2001
From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
Date: Tue, 24 Mar 2015 21:54:05 +0900
Subject: [PATCH] Fix bug that inflater->nvbufs is not reset

---
 lib/nghttp2_buf.c        | 22 +++++++---------------
 lib/nghttp2_buf.h        |  5 ++---
 lib/nghttp2_hd.c         |  2 ++
 lib/nghttp2_hd.h         |  3 +--
 tests/nghttp2_buf_test.c |  3 +--
 5 files changed, 13 insertions(+), 22 deletions(-)

diff --git a/lib/nghttp2_buf.c b/lib/nghttp2_buf.c
index a9fd3f84..415c414d 100644
--- a/lib/nghttp2_buf.c
+++ b/lib/nghttp2_buf.c
@@ -410,31 +410,23 @@ ssize_t nghttp2_bufs_remove(nghttp2_bufs *bufs, uint8_t **out) {
     len += nghttp2_buf_len(&chain->buf);
   }
 
-  if (!len) {
+  if (len == 0) {
     res = NULL;
-  } else {
-    res = nghttp2_mem_malloc(bufs->mem, len);
+    return 0;
+  }
 
-    if (res == NULL) {
-      return NGHTTP2_ERR_NOMEM;
-    }
+  res = nghttp2_mem_malloc(bufs->mem, len);
+  if (res == NULL) {
+    return NGHTTP2_ERR_NOMEM;
   }
 
   nghttp2_buf_wrap_init(&resbuf, res, len);
 
   for (chain = bufs->head; chain; chain = chain->next) {
     buf = &chain->buf;
-
-    if (resbuf.last) {
-      resbuf.last = nghttp2_cpymem(resbuf.last, buf->pos, nghttp2_buf_len(buf));
-    }
-
-    nghttp2_buf_reset(buf);
-    nghttp2_buf_shift_right(&chain->buf, bufs->offset);
+    resbuf.last = nghttp2_cpymem(resbuf.last, buf->pos, nghttp2_buf_len(buf));
   }
 
-  bufs->cur = bufs->head;
-
   *out = res;
 
   return (ssize_t)len;
diff --git a/lib/nghttp2_buf.h b/lib/nghttp2_buf.h
index c0455181..9b6d149c 100644
--- a/lib/nghttp2_buf.h
+++ b/lib/nghttp2_buf.h
@@ -313,9 +313,8 @@ int nghttp2_bufs_orb_hold(nghttp2_bufs *bufs, uint8_t b);
  * function allocates the contagious memory to store all data in
  * |bufs| and assigns it to |*out|.
  *
- * On successful return, nghttp2_bufs_len(bufs) returns 0, just like
- * after calling nghttp2_bufs_reset().
-
+ * The contents of |bufs| is left unchanged.
+ *
  * This function returns the length of copied data and assigns the
  * pointer to copied data to |*out| if it succeeds, or one of the
  * following negative error codes:
diff --git a/lib/nghttp2_hd.c b/lib/nghttp2_hd.c
index 2c21afe6..7acc1c71 100644
--- a/lib/nghttp2_hd.c
+++ b/lib/nghttp2_hd.c
@@ -1328,6 +1328,8 @@ static int hd_inflate_remove_bufs(nghttp2_hd_inflater *inflater, nghttp2_nv *nv,
       return NGHTTP2_ERR_NOMEM;
     }
 
+    nghttp2_bufs_reset(&inflater->nvbufs);
+
     buflen = rv;
 
     if (value_only) {
diff --git a/lib/nghttp2_hd.h b/lib/nghttp2_hd.h
index 178abe36..d4616795 100644
--- a/lib/nghttp2_hd.h
+++ b/lib/nghttp2_hd.h
@@ -324,8 +324,7 @@ void nghttp2_hd_huff_decode_context_init(nghttp2_hd_huff_decode_context *ctx);
  * be initialized by nghttp2_hd_huff_decode_context_init(). The result
  * will be added to |dest|. This function may expand |dest| as
  * needed. The caller is responsible to release the memory of |dest|
- * by calling nghttp2_bufs_free() or export its content using
- * nghttp2_bufs_remove().
+ * by calling nghttp2_bufs_free().
  *
  * The caller must set the |final| to nonzero if the given input is
  * the final block.
diff --git a/tests/nghttp2_buf_test.c b/tests/nghttp2_buf_test.c
index 3b1317d1..01f31fcf 100644
--- a/tests/nghttp2_buf_test.c
+++ b/tests/nghttp2_buf_test.c
@@ -198,8 +198,7 @@ void test_nghttp2_bufs_remove(void) {
   CU_ASSERT(11 == outlen);
 
   CU_ASSERT(0 == memcmp("hello world", out, outlen));
-  CU_ASSERT(0 == nghttp2_bufs_len(&bufs));
-  CU_ASSERT(bufs.cur->buf.pos == bufs.cur->buf.begin);
+  CU_ASSERT(11 == nghttp2_bufs_len(&bufs));
 
   mem->free(out, NULL);
   nghttp2_bufs_free(&bufs);