From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 20 Oct 2026 12:18:32 +0000 (+0200)
Subject: BUG/MINOR: h3: fix crash with maxrewrite on response headers
X-Git-Tag: v3.5-dev10~99
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=01894641e9b2008c7d7676e3391bc41be767ef20;p=haproxy.git

BUG/MINOR: h3: fix crash with maxrewrite on response headers

This patch is similar to the previous one. This time it enforces HTTP
headers maxrewrite setting on responses parsing from the server to the
client. Thus, this change is related to the backend side handling.

As a side effect, it also prevents a BUG_ON() crash on
qcs_http_rcv_buf(). Indeed, maxrewrite is also used by the stream layer
to reduce the destination buffer. Thus, htx_xfer() may be interrupted
due to a lack of space after setting HTX_FL_PARSING_ERROR flag. This
triggers the BUG_ON() in qcs_http_rcv_buf(). This does not happen on
frontend side with requests as HTX buffer is passed to the newly created
stream instance without rcv_buf invocation.

This should be backported up to 3.3.
---

diff --git a/src/h3.c b/src/h3.c
index ed6463374..a64ad4bd4 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -1467,6 +1467,13 @@ static ssize_t h3_resp_headers_to_htx(struct qcs *qcs, const struct buffer *buf,
 	if (fin)
 		htx_set_eom(htx);
 
+	/* Check that at least reserved space remains after headers decoding. */
+	if (htx_free_space(htx) < global.tune.maxrewrite) {
+		/* TODO should be a stream level error instead of a connection one. */
+		len = -1;
+		goto out;
+	}
+
 	/* Detect if an interim or final response was handled. */
 	if (sl->info.res.status >= 100 && sl->info.res.status < 200) {
 		TRACE_USER("receiving interim response", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);