BUG/MINOR: mux_quic: extend FINAL_SIZE_ERROR detection on stream

On STREAM reception, a frame is rejected if final size is known but a
frame which exceeds it is received. Connection is closed with
FINAL_SIZE_ERROR code. This is also the case for a frame with FIN set
but shorter than the already received maximum offset.

This patch rewrites the condition so that the second check on frame with
FIN is always performed. Indeed, it does not depend on the known final
size status. A similar test is already performed as expected in the
RESET_STREAM frame handler.

This must be backported up to 2.6.

diff --git a/src/mux_quic.c b/src/mux_quic.c
index 720ef93708a7c870af7da1dffe7bccb4883b26fb..b9ae11551216f2689bde91390009836dab5a1e1e 100644 (file)
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -2002,8 +2002,8 @@ int qcc_recv(struct qcc *qcc, uint64_t id, uint64_t len, uint64_t offset,
         * of type FINAL_SIZE_ERROR; see Section 11 for details on error
         * handling.
         */
-       if (qcs->flags & QC_SF_SIZE_KNOWN &&
-           (offset + len > qcs->rx.offset_max || (fin && offset + len < qcs->rx.offset_max))) {
+       if (((qcs->flags & QC_SF_SIZE_KNOWN) && offset + len > qcs->rx.offset_max) ||
+           (fin && offset + len < qcs->rx.offset_max)) {
                TRACE_ERROR("final size error", QMUX_EV_QCC_RECV|QMUX_EV_QCS_RECV|QMUX_EV_PROTO_ERR, qcc->conn, qcs);
                qcc_set_error(qcc, QC_ERR_FINAL_SIZE_ERROR, 0,
                              muxc_tevt_type_proto_err);