Fix chunked body decoding

History.md

@@ -2,6 +2,7 @@
 * Bugfixes
   * Resolve issue with threadpool waiting counter decrement when thread is killed
   * Constrain rake-compiler version to 0.9.4 to fix `ClassNotFound` exception when using MiniSSL with Java8.
+  * Fix corner case when request body is chunked (#2326)
 
 ## 5.0.0
 

lib/puma/client.rb

@@ -456,7 +456,15 @@ def decode_chunk(chunk)
           chunk = chunk[@partial_part_left..-1]
           @partial_part_left = 0
         else
-          write_chunk(chunk) if @partial_part_left > 2 # don't include the last \r\n
+          if @partial_part_left > 2
+            if @partial_part_left == chunk.size + 1
+              # Don't include the last \r
+              write_chunk(chunk[0..(@partial_part_left-3)])
+            else
+              # don't include the last \r\n
+              write_chunk(chunk)
+            end
+          end
           @partial_part_left -= chunk.size
           return false
         end

test/test_puma_server.rb

@@ -512,6 +512,36 @@ def test_chunked_request
     assert_equal 5, content_length
   end
 
+  def test_large_chunked_request
+    body = nil
+    content_length = nil
+    server_run app: ->(env) {
+      body = env['rack.input'].read
+      content_length = env['CONTENT_LENGTH']
+      [200, {}, [""]]
+    }
+
+    header = "GET / HTTP/1.1\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n"
+
+    chunk_header_size = 6 # 4fb8\r\n
+    # Current implementation reads one chunk of CHUNK_SIZE, then more chunks of size 4096.
+    # We want a chunk to split exactly after "#{request_body}\r", before the "\n".
+    edge_case_size = Puma::Const::CHUNK_SIZE + 4096 - header.size - chunk_header_size - 1
+
+    margin = 0 # 0 for only testing this specific case, increase to test more surrounding sizes
+    (-margin..margin).each do |i|
+      size = edge_case_size + i
+      request_body = '.' * size
+      request = "#{header}#{size.to_s(16)}\r\n#{request_body}\r\n0\r\n\r\n"
+
+      data = send_http_and_read request
+
+      assert_equal "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Length: 0\r\n\r\n", data
+      assert_equal size, content_length
+      assert_equal request_body, body
+    end
+  end
+
   def test_chunked_request_pause_before_value
     body = nil
     content_length = nil