From b5fde1e57458bd0790f8c84c595ae76663e762fe Mon Sep 17 00:00:00 2001 From: Amaury Denoyelle Date: Tue, 29 Sep 2026 11:49:13 +0200 Subject: [PATCH] BUG/MINOR: mux_quic: extend FINAL_SIZE_ERROR detection on stream On STREAM reception, a frame is rejected if final size is known but a frame which exceeds it is received. Connection is closed with FINAL_SIZE_ERROR code. This is also the case for a frame with FIN set but shorter than the already received maximum offset. This patch rewrites the condition so that the second check on frame with FIN is always performed. Indeed, it does not depend on the known final size status. A similar test is already performed as expected in the RESET_STREAM frame handler. This must be backported up to 2.6. --- src/mux_quic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/mux_quic.c b/src/mux_quic.c index 720ef9370..b9ae11551 100644 --- a/src/mux_quic.c +++ b/src/mux_quic.c @@ -2002,8 +2002,8 @@ int qcc_recv(struct qcc *qcc, uint64_t id, uint64_t len, uint64_t offset, * of type FINAL_SIZE_ERROR; see Section 11 for details on error * handling. */ - if (qcs->flags & QC_SF_SIZE_KNOWN && - (offset + len > qcs->rx.offset_max || (fin && offset + len < qcs->rx.offset_max))) { + if (((qcs->flags & QC_SF_SIZE_KNOWN) && offset + len > qcs->rx.offset_max) || + (fin && offset + len < qcs->rx.offset_max)) { TRACE_ERROR("final size error", QMUX_EV_QCC_RECV|QMUX_EV_QCS_RECV|QMUX_EV_PROTO_ERR, qcc->conn, qcs); qcc_set_error(qcc, QC_ERR_FINAL_SIZE_ERROR, 0, muxc_tevt_type_proto_err); -- 2.47.3