From 8fc3da2fc31a04281b0ba8dc0cdc1e1650067da5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lo=C3=AFc=20Hoguin?= <essen@ninenines.eu>
Date: Fri, 7 Feb 2020 11:32:15 +0100
Subject: Fix HTTP/1.1 bug when a flow command is returned after fin

This resulted in a badarith error due to the current flow being
set to infinity when the body has been fully read. A test case
has been added reproducing the issue.
---
 src/cowboy_http.erl                |  3 +++
 test/handlers/stream_handler_h.erl |  4 ++++
 test/stream_handler_SUITE.erl      | 13 +++++++++++++
 3 files changed, 20 insertions(+)

diff --git a/src/cowboy_http.erl b/src/cowboy_http.erl
index 9f0b865..13d07b7 100644
--- a/src/cowboy_http.erl
+++ b/src/cowboy_http.erl
@@ -970,6 +970,9 @@ commands(State=#state{out_streamid=Current, streams=Streams0}, StreamID, Command
 	Streams = lists:keyreplace(StreamID, #stream.id, Streams0,
 		Stream#stream{queue=Queue ++ Commands}),
 	State#state{streams=Streams};
+%% When we have finished reading the request body, do nothing.
+commands(State=#state{flow=infinity}, StreamID, [{flow, _}|Tail]) ->
+	commands(State, StreamID, Tail);
 %% Read the request body.
 commands(State0=#state{flow=Flow0}, StreamID, [{flow, Size}|Tail]) ->
 	%% We must read *at least* Size of data otherwise functions
diff --git a/test/handlers/stream_handler_h.erl b/test/handlers/stream_handler_h.erl
index 3761e11..370d15a 100644
--- a/test/handlers/stream_handler_h.erl
+++ b/test/handlers/stream_handler_h.erl
@@ -34,6 +34,8 @@ init_commands(_, _, #state{test=crash_in_terminate}) ->
 	[{response, 200, #{<<"content-length">> => <<"12">>}, <<"Hello world!">>}, stop];
 init_commands(_, _, #state{test=crash_in_early_error}) ->
 	error(crash);
+init_commands(_, _, #state{test=flow_after_body_fully_read}) ->
+	[];
 init_commands(_, _, #state{test=set_options_ignore_unknown}) ->
 	[
 		{set_options, #{unknown_options => true}},
@@ -81,6 +83,8 @@ init_process(TrapExit, #state{pid=Pid}) ->
 
 data(_, _, _, #state{test=crash_in_data}) ->
 	error(crash);
+data(_, fin, <<"Hello world!">>, State=#state{test=flow_after_body_fully_read}) ->
+	{[{flow, 12}, {response, 200, #{}, <<"{}">>}], State};
 data(StreamID, IsFin, Data, State=#state{pid=Pid}) ->
 	Pid ! {Pid, self(), data, StreamID, IsFin, Data, State},
 	{[], State}.
diff --git a/test/stream_handler_SUITE.erl b/test/stream_handler_SUITE.erl
index 1d5bd27..46a05b2 100644
--- a/test/stream_handler_SUITE.erl
+++ b/test/stream_handler_SUITE.erl
@@ -282,6 +282,19 @@ early_error_stream_error_reason(Config) ->
 	{response, fin, Status, _} = gun:await(ConnPid, Ref),
 	ok.
 
+flow_after_body_fully_read(Config) ->
+	doc("A flow command may be returned even after the body was read fully."),
+	Self = self(),
+	ConnPid = gun_open(Config),
+	Ref = gun:post(ConnPid, "/long_polling", [
+		{<<"x-test-case">>, <<"flow_after_body_fully_read">>},
+		{<<"x-test-pid">>, pid_to_list(Self)}
+	], <<"Hello world!">>),
+	%% Receive a 200 response, sent after the second flow command,
+	%% confirming that the flow command was accepted.
+	{response, _, 200, _} = gun:await(ConnPid, Ref),
+	ok.
+
 set_options_ignore_unknown(Config) ->
 	doc("Confirm that unknown options are ignored when using the set_options commands."),
 	Self = self(),
-- 
cgit v1.2.3