From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Thu, 8 Oct 2026 17:24:20 +0000 (+0200)
Subject: BUG/MEDIUM: h3: fix incorrect DATA size block on DEM FULL
X-Git-Tag: v3.5-dev9~169
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=fe8a8c322e593d5752c1f9cacbc3a35492382f6e;p=haproxy.git

BUG/MEDIUM: h3: fix incorrect DATA size block on DEM FULL

The following patch fixes h3_data_to_htx() to ensure the correct value
is returned in case of buffer wrapper.

  bcdbc399d34f82a21c49162f203f2ff16b0aed79
  BUG/MEDIUM: h3: fix end-of-input report on DATA wrapping

However, this introduces a regression when HTX buffer is smaller than
the copied block. In this case, QCS is flagged with QC_SF_DEM_FULL, but
early goto skip the increment on <htx_sent> total value.

This causes corrupted transfers with H3 POST larger than a bufsize
resulting in a larger payload. This is caused by duplicated data blocks
when copy resumes after hitting QC_SF_DEM_FULL condition.

Fix this by ensuring <htx_sent> is always updated before the early goto
path. Intent of the above fix is kept as well as <ret> still serves as a
comparison for QC_SF_DEM_FULL / EOM cases.

This must be backported along the above patch, planned up to 2.6 (after
a period of observation).
---

diff --git a/src/h3.c b/src/h3.c
index 57b2c00bd..78655e314 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -1727,7 +1727,7 @@ static ssize_t h3_data_to_htx(struct qcs *qcs, const struct buffer *buf,
 		goto retry;
 	}
 
-	ret = htx_add_data(htx, ist2(head, len));
+	htx_sent += ret = htx_add_data(htx, ist2(head, len));
 	if (ret < len) {
 		qcs->flags |= QC_SF_DEM_FULL;
 		goto out;
@@ -1735,7 +1735,6 @@ static ssize_t h3_data_to_htx(struct qcs *qcs, const struct buffer *buf,
 
 	if (fin && len == ret)
 		htx_set_eom(htx);
-	htx_sent += ret;
 
  out:
 	if (appbuf)