From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Mon, 19 Oct 2026 12:04:07 +0000 (+0200)
Subject: BUG/MINOR: h3: fix BUG_ON() crash with glitch on htx_set_eom() failure
X-Git-Tag: v3.5-dev10~110
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=c2d82a20b;p=haproxy.git

BUG/MINOR: h3: fix BUG_ON() crash with glitch on htx_set_eom() failure

In case of htx_set_eom() failure, qcc_set_error() is used both for DATA
and trailers parsing, setting INTERNAL_ERROR as value. Both parsers
return a negative value to interrupt h3_rcv_buf() parsing loop. However,
this causes a crash as qcc_set_error() is called a second time on the
function epilogue.

Fix this by removing qcc_set_error() usage in both h3_data_to_htx() /
h3_trailers_to_htx(). They still return a negative value, which is now
properly handled in h3_rcv_buf() epilogue : INTERNAL_ERROR is set as
both h3c <err> and h3s <err> are unset.

This must be backported up to 3.0.
---

diff --git a/src/h3.c b/src/h3.c
index fcca8c45e..c49f8849d 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -1563,8 +1563,6 @@ static ssize_t h3_trailers_to_htx(struct qcs *qcs, const struct buffer *buf,
 		/* Ensure EOM is reported when an empty frame is handled. */
 		if (!htx_set_eom(htx)) {
 			TRACE_ERROR("cannot set EOM", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
-			qcc_set_error(qcs->qcc, H3_ERR_INTERNAL_ERROR, 1,
-			              muxc_tevt_type_internal_err);
 			len = -1;
 			goto out;
 		}
@@ -1681,8 +1679,6 @@ static ssize_t h3_data_to_htx(struct qcs *qcs, const struct buffer *buf,
 		/* Ensure EOM is reported when an empty frame is handled. */
 		if (!htx_set_eom(htx)) {
 			TRACE_ERROR("cannot set EOM", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
-			qcc_set_error(qcs->qcc, H3_ERR_INTERNAL_ERROR, 1,
-			              muxc_tevt_type_internal_err);
 			goto err;
 		}