BUG/MINOR: h3: fix risk of BUG_ON() crash with glitch on unknown frame

The following patch extend parsing for HTTP/3 unknown frame type with
FIN set to ensure that closure is notified to the upper layer.

  fe1da6850ab3e89e242c1d8d53ef17a1ba1dee6b
  BUG/MINOR: h3: handle unknown frame type on request stream as specified

The first objective is to report a stream error if the stream is closed
without any request seen. However, this case does not prevent to report
an HTX EOM which is unnecessary. Worst, it could cause a crash if EOM
fails due to an internal error, as qcc_set_error() could be called a
second times after glitch reporting.

Fix both issues by interrupting parsing as soon as the stream level
error is set.

This must be backported up to 3.0.

diff --git a/src/h3.c b/src/h3.c
index b4946fbc68326eb724d9d959b02cfa53a0b045e8..fcca8c45e842421e62e1127c358df035027aa3c3 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -2250,6 +2250,7 @@ static ssize_t h3_rcv_buf(struct qcs *qcs, struct buffer *b, int fin)
                                        h3s->err = H3_ERR_MESSAGE_ERROR;
                                        qcc_report_glitch(qcs->qcc, 1);
                                        ret = -1;
+                                       break;
                                }
 
                                /* Reuse wrapper function to easily set EOM on HTX message. */