BUG/MEDIUM: mux-h1: Skip UNUSED htx block when formating the start line

UNUSED blocks were not properly handled when the H1 multiplexer was
formatting the start line of a request or a response. UNUSED was ignored but
not removed from HTX message. So the mux can loop infinitly on such block.

It could be seen a a major issue but in fact it happens only if a very
specific case on the reponse processing (at least I think so): the server
must send an interim message (a 100-continue for intance) with the final
response. HAProxy must receive both in same time and the final reponse must
be intercepted (via a http-response return action for instance), In that
case, the interim message is fowarded and the server final reponse is
removed and replaced by a proxy error message.

Now UNUSED htx blocks are properly skipped and removed.

This patch must be backported as far as 3.0.

(cherry picked from commit a3e9a04)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 53b7d7a)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 1b8806e)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit f64d86d)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>

Author: capflam

src/mux_h1.c

@@ -2302,8 +2302,10 @@ static size_t h1_make_reqline(struct h1s *h1s, struct h1m *h1m, struct htx *htx,
 			goto end;
 		type = htx_get_blk_type(blk);
 		sz = htx_get_blksz(blk);
-		if (type == HTX_BLK_UNUSED)
+		if (type == HTX_BLK_UNUSED) {
+			htx_remove_blk(htx, blk);
 			continue;
+		}
 		if (type != HTX_BLK_REQ_SL || sz > count)
 			goto error;
 		break;
@@ -2391,8 +2393,10 @@ static size_t h1_make_stline(struct h1s *h1s, struct h1m *h1m, struct htx *htx,
 		type = htx_get_blk_type(blk);
 		sz = htx_get_blksz(blk);
 
-		if (type == HTX_BLK_UNUSED)
+		if (type == HTX_BLK_UNUSED) {
+			htx_remove_blk(htx, blk);
 			continue;
+		}
 		if (type != HTX_BLK_RES_SL || sz > count)
 			goto error;
 		break;