From: Frederic Lecaille <flecaille@haproxy.com>
Date: Thu, 3 Sep 2026 08:16:59 +0000 (+0200)
Subject: BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure
X-Git-Tag: v3.5-dev7~85
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=055f5a7f49eccec1987fd37c4bb813357d14f194;p=haproxy.git

BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure

In quic_build_post_handshake_frames(), the NEW_TOKEN frame is appended to the
local frame list only after its token is generated. The error path taken when
quic_generate_token() fails frees that list, and therefore never sees the frame.
This only happens on a memory allocation failure, when the AEAD context used to
cipher the token cannot be created.

Append the frame as soon as it is allocated, as done just above for the
HANDSHAKE_DONE frame.

This bug was introduced by commit f627b9272 ("BUG/MEDIUM: quic: always validate
sender address on 0-RTT").

This should be backported as far as 3.0.
---

diff --git a/src/quic_conn.c b/src/quic_conn.c
index 15ab7857a..1f435a44d 100644
--- a/src/quic_conn.c
+++ b/src/quic_conn.c
@@ -465,6 +465,8 @@ int quic_build_post_handshake_frames(struct quic_conn *qc,
 			goto err;
 		}
 
+		LIST_APPEND(&frm_list, &frm->list);
+
 		new_token_frm_len =
 			quic_generate_token(frm->new_token.w_data,
 			                    sizeof(frm->new_token.w_data), &qc->peer_addr);
@@ -475,7 +477,6 @@ int quic_build_post_handshake_frames(struct quic_conn *qc,
 
 		BUG_ON(new_token_frm_len != sizeof(frm->new_token.w_data));
 		frm->new_token.len = new_token_frm_len;
-		LIST_APPEND(&frm_list, &frm->list);
 	}
 
 	/* Initialize <max> connection IDs minus one: there is