From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 29 Sep 2026 09:48:54 +0000 (+0200)
Subject: BUG/MINOR: h3: close connection on GOAWAY frame too long
X-Git-Tag: v3.5-dev9~176
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=26696c2e96f2395ed8389af959f10d2af50b4fca;p=haproxy.git

BUG/MINOR: h3: close connection on GOAWAY frame too long

GOAWAY frame contains a single stream ID varint. When decoding it,
ensure its length match the announced value in frame header. If not the
case, the connection must be closed with code FRAME_ERROR.

This must be backported up to 3.4.
---

diff --git a/src/h3.c b/src/h3.c
index c0d310d96..60b83e5c9 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -1862,6 +1862,13 @@ static ssize_t h3_parse_goaway_frm(struct h3c *h3c, const struct buffer *buf,
 		return -1;
 	}
 
+	if (ret != len) {
+		TRACE_ERROR("mismatch on GOAWAY frame length", H3_EV_RX_FRAME, h3c->qcc->conn);
+		h3c->err = H3_ERR_FRAME_ERROR;
+		qcc_report_glitch(h3c->qcc, 1);
+		return -1;
+	}
+
 	if ((h3c->flags & H3_CF_GOAWAY_RECV) && id > h3c->id_shut_r) {
 		h3c->err = H3_ERR_ID_ERROR;
 		qcc_report_glitch(h3c->qcc, 1);