[PR] Fix connection window credit loss in HTTP/2 backlog accou nting [tomcat]

note89 (via GitHub) <[email protected]> Wed, 29 Jul 2026 09:34:52 -0000
Newsgroups gmane.comp.jakarta.tomcat.devel
Message-ID <[email protected]>
note89 opened a new pull request, #1032:
URL: https://github.com/apache/tomcat/pull/1032

   `backLogSize` is incremented when streams join the backlog, but `allocate()` never decrements it when granting connection window capacity to a backlogged stream. Only the full-clear branch of `releaseBackLog()` resets it. After any partial allocation the aggregate is larger than the sum of the outstanding per-stream requests.
   
   A later `WINDOW_UPDATE` that covers all outstanding requests is then compared against the stale aggregate, takes the partial-allocation branch, and the surplus is discarded instead of being returned to the connection flow control window. Subsequent streams stall waiting for credit the client has already sent, until the write timeout closes the connection with ENHANCE_YOUR_CALM.
   
   In the extended `TestRfc9218` scenario: 10,239 bytes of real backlog, a 16,384-byte update — the 6,145-byte surplus is lost and the next stream receives headers but no data.
   
   Fix: decrement `backLogSize` as allocations are made, keeping it equal to the sum of outstanding requests. The invariant is documented on the field. Also fixes a digit transposition in an existing test comment (5641 -> 5461).
   
   Testing: the extended `TestRfc9218` fails without the fix (next stream starves until read timeout) and passes with it, asserting the exact 6,145-byte surplus plus a 2,047-byte update completing the 8,192-byte body. Full `org.apache.coyote.http2` package passes. The same issue exists on 9.0.x and 10.1.x.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]