From 1f70dbfbb17cea3deae9315c17ff33ec157e1f20 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Wed, 23 Sep 2026 10:01:59 +0200 Subject: [PATCH] BUG/MINOR: mux-h2: Don't expect more HTX data on 1xx interim responses Commit b70921f2c ("BUG/MINOR: mux-h2: Properly handle full or truncated HTX messages on shut") introduced a regression. When the response start-line had the HTX_SL_F_XFER_LEN flag set, the H2 stream was flagged with H2_SF_MORE_HTX_DATA, as if a payload was expected after the response headers. This was also set for 1xx interim responses. If a final response with an unknown length was received (no HTX_SL_F_XFER_LEN set), the flag H2_SF_MORE_HTX_DATA was not removed, leading to an error. The H2 stream was seen as truncated when a shut was performed and it was reset with a RST_STREAM(CANCEL). To fix the issue, H2_SF_MORE_HTX_DATA flag is no longer set for 1XX interim responses. This patch must be backported as far as 2.8. --- src/mux_h2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mux_h2.c b/src/mux_h2.c index 00272fd03..7d0535884 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -6738,7 +6738,7 @@ static size_t h2s_snd_fhdrs(struct h2s *h2s, struct htx *htx) BUG_ON(sl); /* Only one start-line expected */ sl = htx_get_blk_ptr(htx, blk); h2s->status = sl->info.res.status; - if (sl->flags & HTX_SL_F_XFER_LEN) + if ((sl->flags & HTX_SL_F_XFER_LEN) && (h2s->status == 101 || h2s->status >= 200)) h2s->flags |= H2_SF_MORE_HTX_DATA; if ((sl->flags & HTX_SL_F_BODYLESS_RESP) || h2s->status == 204 || h2s->status == 304) h2s->flags |= H2_SF_BODYLESS_RESP; -- 2.47.3