From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Mon, 19 Oct 2026 11:19:49 +0000 (+0200)
Subject: BUG/MEDIUM: h3: fix BUG_ON() crash with glitch on GOAWAY parsing
X-Git-Tag: v3.5-dev10~114
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=fc9a503b1;p=haproxy.git

BUG/MEDIUM: h3: fix BUG_ON() crash with glitch on GOAWAY parsing

This patch fixes glitch reporting after GOAWAY frame parsing. Similar to
the previous commit, qcc_report_glitch() is called only after
qcc_set_error() after h3_parse_goaway_frm().

This must be backported up to 3.4.
---

diff --git a/src/h3.c b/src/h3.c
index 5481aaa94..566819ad3 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -1848,20 +1848,17 @@ static ssize_t h3_parse_goaway_frm(struct h3c *h3c, const struct buffer *buf,
 		 */
 		TRACE_ERROR("truncated GOAWAY frame", H3_EV_RX_FRAME, h3c->qcc->conn);
 		h3c->err = H3_ERR_FRAME_ERROR;
-		qcc_report_glitch(h3c->qcc, 1);
 		return -1;
 	}
 
 	if (ret != len) {
 		TRACE_ERROR("mismatch on GOAWAY frame length", H3_EV_RX_FRAME, h3c->qcc->conn);
 		h3c->err = H3_ERR_FRAME_ERROR;
-		qcc_report_glitch(h3c->qcc, 1);
 		return -1;
 	}
 
 	if ((h3c->flags & H3_CF_GOAWAY_RECV) && id > h3c->id_shut_r) {
 		h3c->err = H3_ERR_ID_ERROR;
-		qcc_report_glitch(h3c->qcc, 1);
 		return -1;
 	}
 
@@ -2180,6 +2177,7 @@ static ssize_t h3_rcv_buf(struct qcs *qcs, struct buffer *b, int fin)
 			if (ret < 0) {
 				TRACE_ERROR("error on GOAWAY parsing", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
 				qcc_set_error(qcs->qcc, h3c->err, 1, muxc_tevt_type_proto_err);
+				qcc_report_glitch(h3c->qcc, 1);
 				goto err;
 			}
 			break;