From 6f59a49d02b282b5bb58e502c5b97bcbe78db084 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Thu, 3 Sep 2026 21:52:38 +0200 Subject: [PATCH] BUG/MINOR: mux-h1: Return an error on trailers if last chunk is unfinished On send patch, there were already some tests to detect truncated chunks, but always when handling an HTX DATA bloc. There was nothing similar on trailers. So it was possibly to emit end of chunks and start to send trailers while the last chunk was unfinished. So it is a bug, but only it could only be triggered if another part is able to emit invalid HTX message. Unfortunatly it was the case. This patch is related to the commit 86a4ebc76 ("BUG/MAJOR: h3: reject H3 truncated frames"). This patch should be backported as far as 3.0. On older versions, the code is too different. --- src/mux_h1.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/mux_h1.c b/src/mux_h1.c index 0587b832d..b412cacb0 100644 --- a/src/mux_h1.c +++ b/src/mux_h1.c @@ -3265,6 +3265,12 @@ static size_t h1_make_data(struct h1s *h1s, struct h1m *h1m, struct buffer *buf, */ } else if (h1m->flags & H1_MF_CHNK) { + if (h1m->curr_len) { + COUNT_IF(1, "chunk smaller than announced"); + TRACE_ERROR("chunk smaller than announced", + H1_EV_TX_DATA|H1_EV_STRM_ERR|H1_EV_H1C_ERR|H1_EV_H1S_ERR, h1c->conn, h1s); + goto error; + } /* Emit last chunk for chunked messages only */ if (!chunk_memcat(&outbuf, "0\r\n", 3)) goto full; -- 2.47.3