BUG/MINOR: h3: fix BUG_ON() crash with glitch on htx_set_eom() failure

In case of htx_set_eom() failure, qcc_set_error() is used both for DATA
and trailers parsing, setting INTERNAL_ERROR as value. Both parsers
return a negative value to interrupt h3_rcv_buf() parsing loop. However,
this causes a crash as qcc_set_error() is called a second time on the
function epilogue.

Fix this by removing qcc_set_error() usage in both h3_data_to_htx() /
h3_trailers_to_htx(). They still return a negative value, which is now
properly handled in h3_rcv_buf() epilogue : INTERNAL_ERROR is set as
both h3c <err> and h3s <err> are unset.

This must be backported up to 3.0.

diff --git a/src/h3.c b/src/h3.c
index fcca8c45e842421e62e1127c358df035027aa3c3..c49f8849d126eb1a59551097a9ed97760e6b609e 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -1563,8 +1563,6 @@ static ssize_t h3_trailers_to_htx(struct qcs *qcs, const struct buffer *buf,
                /* Ensure EOM is reported when an empty frame is handled. */
                if (!htx_set_eom(htx)) {
                        TRACE_ERROR("cannot set EOM", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
-                       qcc_set_error(qcs->qcc, H3_ERR_INTERNAL_ERROR, 1,
-                                     muxc_tevt_type_internal_err);
                        len = -1;
                        goto out;
                }
@@ -1681,8 +1679,6 @@ static ssize_t h3_data_to_htx(struct qcs *qcs, const struct buffer *buf,
                /* Ensure EOM is reported when an empty frame is handled. */
                if (!htx_set_eom(htx)) {
                        TRACE_ERROR("cannot set EOM", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
-                       qcc_set_error(qcs->qcc, H3_ERR_INTERNAL_ERROR, 1,
-                                     muxc_tevt_type_internal_err);
                        goto err;
                }