From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Thu, 22 Oct 2026 12:53:59 +0000 (+0200)
Subject: BUG/MINOR: mux_quic: fix overflow on avail_streams
X-Git-Tag: v3.5-dev10~74
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=6d42822084442cc10ba81275bf2e4d706ececda7;p=haproxy.git

BUG/MINOR: mux_quic: fix overflow on avail_streams

Function qcc_fctl_avail_streams() return the number of streams which can
still be opened regarding the limit set by the peer.

The return value is a 32 bits integer, used to store the substraction
result. This may overflow as flow control limit is encoded on 64 bits,
which could result either in blocked transfers, or in spurrious error as
mandatory unistreams could not be opened.

Fix this by using a temporary 64 bits value, and cap it to INT_MAX if
needed. This is sufficient as values larger than INT_MAX is out of a
real case usage.

This must be backported up to 2.8.
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index c67364bed..a7925ddb9 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -887,16 +887,21 @@ int _qcc_report_glitch(struct qcc *qcc, int inc)
 /* Returns the number of streams which can still be opened until flow-control limit. */
 int qcc_fctl_avail_streams(const struct qcc *qcc, int bidi)
 {
+	uint64_t diff;
+
 	if (bidi) {
 		const uint64_t next = qcc->next_bidi_l / 4;
 		BUG_ON(qcc->rfctl.ms_bidi < next);
-		return qcc->rfctl.ms_bidi - next;
+		diff = qcc->rfctl.ms_bidi - next;
 	}
 	else {
 		const uint64_t next = qcc->next_uni_l / 4;
 		BUG_ON(qcc->rfctl.ms_uni < next);
-		return qcc->rfctl.ms_uni - next;
+		diff = qcc->rfctl.ms_uni - next;
 	}
+
+	/* cap the value to INT_MAX to avoid overflow */
+	return MIN(diff, INT_MAX);
 }
 
 /* Retrieves the maximum number of bidirectional remote streams that the peer