From: Frederic Lecaille <flecaille@haproxy.com>
Date: Wed, 2 Sep 2026 07:41:33 +0000 (+0200)
Subject: BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached
X-Git-Tag: v3.5-dev6~15
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=4cad64fe4abf4b16c3c608b1e73b7ff17162bd3b;p=haproxy.git

BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached

qpack_decode_fs() parses the field section prefix but never looks at the
result. haproxy advertises a null dynamic table capacity, so a conformant
encoder cannot produce a non null Encoded Required Insert Count, and RFC 9204
4.5.1.1 asks for QPACK_DECOMPRESSION_FAILED in that case. It is now rejected.

Nothing could be done with the accepted prefix, as every field line
representation referencing the dynamic table is already rejected, so this is a
compliance fix rather than a security one.

This should be backported as far as 2.6.
---

diff --git a/src/qpack-dec.c b/src/qpack-dec.c
index 2f9d891a7..4be5c9c60 100644
--- a/src/qpack-dec.c
+++ b/src/qpack-dec.c
@@ -298,6 +298,16 @@ int qpack_decode_fs(const unsigned char *raw, uint64_t len, struct buffer *tmp,
 		goto out;
 	}
 
+	/* RFC 9204 4.5.1.1
+	 * haproxy advertises a null dynamic table capacity, so a conformant
+	 * encoder cannot produce a non null Encoded Required Insert Count.
+	 */
+	if (enc_ric) {
+		qpack_debug_printf(stderr, "##ERR@%d\n", __LINE__);
+		ret = -QPACK_RET_DECOMP;
+		goto out;
+	}
+
 	chunk_reset(tmp);
 	qpack_debug_printf(stderr, "enc_ric: %llu db: %llu s=%d\n", 
 	                   (unsigned long long)enc_ric, (unsigned long long)db, !!s);