From 055f5a7f49eccec1987fd37c4bb813357d14f194 Mon Sep 17 00:00:00 2001 From: Frederic Lecaille Date: Thu, 3 Sep 2026 10:16:59 +0200 Subject: [PATCH] BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure In quic_build_post_handshake_frames(), the NEW_TOKEN frame is appended to the local frame list only after its token is generated. The error path taken when quic_generate_token() fails frees that list, and therefore never sees the frame. This only happens on a memory allocation failure, when the AEAD context used to cipher the token cannot be created. Append the frame as soon as it is allocated, as done just above for the HANDSHAKE_DONE frame. This bug was introduced by commit f627b9272 ("BUG/MEDIUM: quic: always validate sender address on 0-RTT"). This should be backported as far as 3.0. --- src/quic_conn.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/quic_conn.c b/src/quic_conn.c index 15ab7857a..1f435a44d 100644 --- a/src/quic_conn.c +++ b/src/quic_conn.c @@ -465,6 +465,8 @@ int quic_build_post_handshake_frames(struct quic_conn *qc, goto err; } + LIST_APPEND(&frm_list, &frm->list); + new_token_frm_len = quic_generate_token(frm->new_token.w_data, sizeof(frm->new_token.w_data), &qc->peer_addr); @@ -475,7 +477,6 @@ int quic_build_post_handshake_frames(struct quic_conn *qc, BUG_ON(new_token_frm_len != sizeof(frm->new_token.w_data)); frm->new_token.len = new_token_frm_len; - LIST_APPEND(&frm_list, &frm->list); } /* Initialize connection IDs minus one: there is -- 2.47.3