Fix bug that inflater->nvbufs is not reset

lib/nghttp2_buf.c

@@ -410,31 +410,23 @@ ssize_t nghttp2_bufs_remove(nghttp2_bufs *bufs, uint8_t **out) {
     len += nghttp2_buf_len(&chain->buf);
   }
 
-  if (!len) {
+  if (len == 0) {
     res = NULL;
-  } else {
-    res = nghttp2_mem_malloc(bufs->mem, len);
+    return 0;
+  }
 
-    if (res == NULL) {
-      return NGHTTP2_ERR_NOMEM;
-    }
+  res = nghttp2_mem_malloc(bufs->mem, len);
+  if (res == NULL) {
+    return NGHTTP2_ERR_NOMEM;
   }
 
   nghttp2_buf_wrap_init(&resbuf, res, len);
 
   for (chain = bufs->head; chain; chain = chain->next) {
     buf = &chain->buf;
-
-    if (resbuf.last) {
-      resbuf.last = nghttp2_cpymem(resbuf.last, buf->pos, nghttp2_buf_len(buf));
-    }
-
-    nghttp2_buf_reset(buf);
-    nghttp2_buf_shift_right(&chain->buf, bufs->offset);
+    resbuf.last = nghttp2_cpymem(resbuf.last, buf->pos, nghttp2_buf_len(buf));
   }
 
-  bufs->cur = bufs->head;
-
   *out = res;
 
   return (ssize_t)len;

lib/nghttp2_buf.h

@@ -313,9 +313,8 @@ int nghttp2_bufs_orb_hold(nghttp2_bufs *bufs, uint8_t b);
  * function allocates the contagious memory to store all data in
  * |bufs| and assigns it to |*out|.
  *
- * On successful return, nghttp2_bufs_len(bufs) returns 0, just like
- * after calling nghttp2_bufs_reset().
-
+ * The contents of |bufs| is left unchanged.
+ *
  * This function returns the length of copied data and assigns the
  * pointer to copied data to |*out| if it succeeds, or one of the
  * following negative error codes:

lib/nghttp2_hd.c

@@ -1328,6 +1328,8 @@ static int hd_inflate_remove_bufs(nghttp2_hd_inflater *inflater, nghttp2_nv *nv,
       return NGHTTP2_ERR_NOMEM;
     }
 
+    nghttp2_bufs_reset(&inflater->nvbufs);
+
     buflen = rv;
 
     if (value_only) {

lib/nghttp2_hd.h

@@ -324,8 +324,7 @@ void nghttp2_hd_huff_decode_context_init(nghttp2_hd_huff_decode_context *ctx);
  * be initialized by nghttp2_hd_huff_decode_context_init(). The result
  * will be added to |dest|. This function may expand |dest| as
  * needed. The caller is responsible to release the memory of |dest|
- * by calling nghttp2_bufs_free() or export its content using
- * nghttp2_bufs_remove().
+ * by calling nghttp2_bufs_free().
  *
  * The caller must set the |final| to nonzero if the given input is
  * the final block.

tests/nghttp2_buf_test.c

@@ -198,8 +198,7 @@ void test_nghttp2_bufs_remove(void) {
   CU_ASSERT(11 == outlen);
 
   CU_ASSERT(0 == memcmp("hello world", out, outlen));
-  CU_ASSERT(0 == nghttp2_bufs_len(&bufs));
-  CU_ASSERT(bufs.cur->buf.pos == bufs.cur->buf.begin);
+  CU_ASSERT(11 == nghttp2_bufs_len(&bufs));
 
   mem->free(out, NULL);
   nghttp2_bufs_free(&bufs);