From c2d82a20b36edf711ecc3626dd47a3e5fa5f7306 Mon Sep 17 00:00:00 2001 From: Amaury Denoyelle Date: Mon, 19 Oct 2026 14:04:07 +0200 Subject: [PATCH] BUG/MINOR: h3: fix BUG_ON() crash with glitch on htx_set_eom() failure In case of htx_set_eom() failure, qcc_set_error() is used both for DATA and trailers parsing, setting INTERNAL_ERROR as value. Both parsers return a negative value to interrupt h3_rcv_buf() parsing loop. However, this causes a crash as qcc_set_error() is called a second time on the function epilogue. Fix this by removing qcc_set_error() usage in both h3_data_to_htx() / h3_trailers_to_htx(). They still return a negative value, which is now properly handled in h3_rcv_buf() epilogue : INTERNAL_ERROR is set as both h3c and h3s are unset. This must be backported up to 3.0. --- src/h3.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/h3.c b/src/h3.c index fcca8c45e..c49f8849d 100644 --- a/src/h3.c +++ b/src/h3.c @@ -1563,8 +1563,6 @@ static ssize_t h3_trailers_to_htx(struct qcs *qcs, const struct buffer *buf, /* Ensure EOM is reported when an empty frame is handled. */ if (!htx_set_eom(htx)) { TRACE_ERROR("cannot set EOM", H3_EV_RX_FRAME, qcs->qcc->conn, qcs); - qcc_set_error(qcs->qcc, H3_ERR_INTERNAL_ERROR, 1, - muxc_tevt_type_internal_err); len = -1; goto out; } @@ -1681,8 +1679,6 @@ static ssize_t h3_data_to_htx(struct qcs *qcs, const struct buffer *buf, /* Ensure EOM is reported when an empty frame is handled. */ if (!htx_set_eom(htx)) { TRACE_ERROR("cannot set EOM", H3_EV_RX_FRAME, qcs->qcc->conn, qcs); - qcc_set_error(qcs->qcc, H3_ERR_INTERNAL_ERROR, 1, - muxc_tevt_type_internal_err); goto err; } -- 2.47.3