Fix several BUGs in hpack.c

- We should check return code of `tfw_hpack_exp_hdr`
  in `BUFFER_VAL_OPEN` and return error if allocation
  fails to prevent BUG.
- Save `it->next` before call `tfw_hpack_exp_hdr` in
  `tfw_hpack_huffman_write` and restore `it->next`
  after this call. There is a small chance that during
  `tfw_hpack_exp_hdr->tfw_str_add_compound->__str_grow_tree`
  new pages will be allocated in `__tfw_pool_realloc`.
  In this case all chunks in it->hdr will be moved and
  change there addresses, but it->next still points to
  the old chunk address! (This lead to BUG during
  processing header values later, when we iterate over
  all chunks from `it->next`. (See `__hpack_process_hdr_value`)
  This patch fixes this problem - now it->next not a pointer
  it is a number of chunk in `it->hdr`. The number of chunk
  is not changed during call `tfw_hpack_exp_hdr` so even
  if all chunks moved, the number is correct!.

Author: EvgeniiMekhanik

fw/hpack.c

@@ -282,7 +282,7 @@ do {								\
 do {								\
 	(it)->hdr.data = (it)->pos;				\
 	(it)->hdr.len = length;					\
-	(it)->next = &(it)->hdr;				\
+	(it)->next = 0;						\
 } while (0)
 
 #define	BUFFER_NAME_OPEN(length)				\
@@ -311,11 +311,15 @@ do {								\
 			r = -ENOMEM;				\
 			goto out;				\
 		}						\
-		if (!TFW_STR_EMPTY(&it->hdr))			\
-			it->next = tfw_hpack_exp_hdr(req->pool,	\
-						     length, it); \
-		else						\
+		if (!TFW_STR_EMPTY(&it->hdr)) {			\
+			r = tfw_hpack_exp_hdr(req->pool, length, \
+					      it); 		\
+			if (unlikely(r))			\
+				return r;			\
+			it->next = it->hdr.nchunks - 1;		\
+		} else	{					\
 			BUFFER_HDR_INIT(length, it);		\
+		}						\
 	}							\
 } while (0)
 
@@ -324,10 +328,10 @@ __hpack_process_hdr_name(TfwHttpReq *req)
 {
 	const TfwStr *c, *end;
 	TfwMsgParseIter *it = &req->pit;
-	const TfwStr *hdr = &it->hdr, *next = it->next;
+	const TfwStr *hdr = &it->hdr;
+	const TfwStr *next = TFW_STR_CHUNK(hdr, it->next);
 	int ret = -EINVAL;
 
-	WARN_ON_ONCE(next != hdr);
 	TFW_STR_FOR_EACH_CHUNK(c, next, end) {
 		bool last = c + 1 == end;
 
@@ -344,7 +348,8 @@ __hpack_process_hdr_value(TfwHttpReq *req)
 {
 	const TfwStr *chunk, *end;
 	TfwMsgParseIter *it = &req->pit;
-	const TfwStr *hdr = &it->hdr, *next = it->next;
+	const TfwStr *hdr = &it->hdr;
+	const TfwStr *next = TFW_STR_CHUNK(hdr, it->next);
 	int ret = -EINVAL;
 
 	BUG_ON(TFW_STR_DUP(hdr));
@@ -431,27 +436,28 @@ write_int(unsigned long index, unsigned short max, unsigned short mask,
 	res_idx->sz = size;
 }
 
-static inline TfwStr *
+static int
 tfw_hpack_exp_hdr(TfwPool *__restrict pool, unsigned long len,
 		  TfwMsgParseIter *__restrict it)
 {
 	TfwStr *new;
 
 	if (!(new = tfw_str_add_compound(pool, &it->hdr)))
-		return NULL;
+		return -ENOMEM;
 
 	new->data = it->pos;
 	new->len = len;
 	it->hdr.len += len;
 
-	return new;
+	return 0;
 }
 
 static inline int
 tfw_hpack_huffman_write(char sym, TfwHttpReq *__restrict req)
 {
-	bool np;
 	TfwMsgParseIter *it = &req->pit;
+	bool np;
+	int r;
 
 	if (it->rspace) {
 		--it->rspace;
@@ -481,7 +487,11 @@ tfw_hpack_huffman_write(char sym, TfwHttpReq *__restrict req)
 		return 0;
 	}
 
-	return tfw_hpack_exp_hdr(req->pool, 1, it) ? 0 : -ENOMEM;
+	r = tfw_hpack_exp_hdr(req->pool, 1, it);
+	if (unlikely(r))
+		return r;
+
+	return 0;
 }
 
 static int

fw/msg.h

@@ -74,11 +74,11 @@ typedef struct {
  * @pos		- pointer to the currently allocated chunk of decoded headers'
  *		  buffer;
  * @rspace	- space remained in the allocated chunk;
- * @next	- pointer to the decoded header part (name/value) to be
- *		- parsed next;
  * @nm_len	- length of the decoded header's name;
  * @nm_num	- chunks number of the decoded header's name;
  * @tag		- tag of currently processed decoded header.
+ * @next	- number of chunk which points to the decoded header part
+ *		  (name/value) to be parsed next;
  */
 typedef struct {
 	TfwPool		*pool;
@@ -89,10 +89,10 @@ typedef struct {
 	TfwStr		hdr;
 	char		*pos;
 	unsigned long	rspace;
-	TfwStr		*next;
 	unsigned long	nm_len;
 	unsigned int	nm_num;
 	unsigned int	tag;
+	unsigned int	next;
 } TfwMsgParseIter;
 
 int tfw_msg_write(TfwMsgIter *it, const TfwStr *data);