From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Thu, 22 Oct 2026 12:22:32 +0000 (+0200)
Subject: BUG/MINOR: mux_quic: fix MAX_STREAMS limit
X-Git-Tag: v3.5-dev10~75
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=26eeba56821dab9a8a6957620993fd7a92bcb4b5;p=haproxy.git

BUG/MINOR: mux_quic: fix MAX_STREAMS limit

A peer may emit a MAX_STREAMS frame to increase the window of opened
streams. Such frame is parsed via qcc_recv_max_streams() since 3.3 as it
is mandatory for backend support.

This patch fixes the maximum value authorized in MAX_STREAMS. As
specified by RFC 9000, it cannot exceed 2^60, the maximum number of
streams of a given type, as stream IDs are encoded on 62 bits with the 2
least significant bits reserved for the type.

This must be backported up to 3.3.
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index 97d4b871e..c67364bed 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -2316,7 +2316,7 @@ int qcc_recv_max_streams(struct qcc *qcc, uint64_t max, int bidi)
 	 *  permits opening of a stream larger than this limit MUST be treated
 	 *  as a connection error of type FRAME_ENCODING_ERROR.
 	 */
-	if (max > QUIC_VARINT_8_BYTE_MAX) {
+	if (max > ((uint64_t)1 << 60)) {
 		TRACE_ERROR("invalid MAX_STREAMS value", QMUX_EV_QCC_RECV, qcc->conn);
 		qcc_set_error(qcc, QC_ERR_FRAME_ENCODING_ERROR, 0,
 		              muxc_tevt_type_proto_err);