From: Azat Khuzhin <a3at.mail@gmail.com>
Date: Tue, 7 Jun 2016 15:31:48 +0000 (+0300)
Subject: buffer: evbuffer_add_buffer(): clean empty chains from destination buffer
X-Git-Tag: release-2.1.6-beta~24^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=26fd9321cffd808bb0d280e55fef3ee4e914b4f7;p=libevent

buffer: evbuffer_add_buffer(): clean empty chains from destination buffer

@EMPanisset reported a problem (#358) with evbuffer_remove_buffer(), but
actually I think that the problem is in evbuffer_add_buffer() which introduces
this empty chain, all other callers (except evbuffer_prepend_buffer(), but it
doesn't have this problem though) should be safe.

And FWIW the only API that allows empty chains is evbuffer_add_reference(), and
we can add check there to avoid such issues, but for now I leaved this without
fixing, since I think that evbuffer_add_reference() with empty chains can be
used as a barrier (but this can be tricky).

Fixes: regress evbuffer/remove_buffer_with_empty2
v2: introduce/fixes evbuffer/add_buffer_with_empty
---

diff --git a/buffer.c b/buffer.c
index c5f1b8a5..6786f902 100644
--- a/buffer.c
+++ b/buffer.c
@@ -885,9 +885,13 @@ APPEND_CHAIN(struct evbuffer *dst, struct evbuffer *src)
 {
 	ASSERT_EVBUFFER_LOCKED(dst);
 	ASSERT_EVBUFFER_LOCKED(src);
-	dst->last->next = src->first;
+
+	struct evbuffer_chain **chp;
+	chp = evbuffer_free_trailing_empty_chains(dst);
+	*chp = src->first;
+
 	if (src->last_with_datap == &src->first)
-		dst->last_with_datap = &dst->last->next;
+		dst->last_with_datap = chp;
 	else
 		dst->last_with_datap = src->last_with_datap;
 	dst->last = src->last;