From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Mon, 19 Oct 2026 12:01:12 +0000 (+0200)
Subject: BUG/MINOR: h3: fix risk of BUG_ON() crash with glitch on unknown frame
X-Git-Tag: v3.5-dev10~111
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=745b120866151add3a56d310535984e5da4aefcc;p=haproxy.git

BUG/MINOR: h3: fix risk of BUG_ON() crash with glitch on unknown frame

The following patch extend parsing for HTTP/3 unknown frame type with
FIN set to ensure that closure is notified to the upper layer.

  fe1da6850ab3e89e242c1d8d53ef17a1ba1dee6b
  BUG/MINOR: h3: handle unknown frame type on request stream as specified

The first objective is to report a stream error if the stream is closed
without any request seen. However, this case does not prevent to report
an HTX EOM which is unnecessary. Worst, it could cause a crash if EOM
fails due to an internal error, as qcc_set_error() could be called a
second times after glitch reporting.

Fix both issues by interrupting parsing as soon as the stream level
error is set.

This must be backported up to 3.0.
---

diff --git a/src/h3.c b/src/h3.c
index b4946fbc6..fcca8c45e 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -2250,6 +2250,7 @@ static ssize_t h3_rcv_buf(struct qcs *qcs, struct buffer *b, int fin)
 					h3s->err = H3_ERR_MESSAGE_ERROR;
 					qcc_report_glitch(qcs->qcc, 1);
 					ret = -1;
+					break;
 				}
 
 				/* Reuse wrapper function to easily set EOM on HTX message. */