From: Christopher Faulet <cfaulet@haproxy.com>
Date: Thu, 3 Sep 2026 19:52:38 +0000 (+0200)
Subject: BUG/MINOR: mux-h1: Return an error on trailers if last chunk is unfinished
X-Git-Tag: v3.5-dev7~81
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=6f59a49d02b282b5bb58e502c5b97bcbe78db084;p=haproxy.git

BUG/MINOR: mux-h1: Return an error on trailers if last chunk is unfinished

On send patch, there were already some tests to detect truncated chunks, but
always when handling an HTX DATA bloc. There was nothing similar on
trailers. So it was possibly to emit end of chunks and start to send
trailers while the last chunk was unfinished.

So it is a bug, but only it could only be triggered if another part is able
to emit invalid HTX message. Unfortunatly it was the case. This patch is
related to the commit 86a4ebc76 ("BUG/MAJOR: h3: reject H3 truncated
frames").

This patch should be backported as far as 3.0. On older versions, the code
is too different.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 0587b832d..b412cacb0 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -3265,6 +3265,12 @@ static size_t h1_make_data(struct h1s *h1s, struct h1m *h1m, struct buffer *buf,
 				 */
 			}
 			else if (h1m->flags & H1_MF_CHNK) {
+				if (h1m->curr_len) {
+					COUNT_IF(1, "chunk smaller than announced");
+					TRACE_ERROR("chunk smaller than announced",
+						    H1_EV_TX_DATA|H1_EV_STRM_ERR|H1_EV_H1C_ERR|H1_EV_H1S_ERR, h1c->conn, h1s);
+					goto error;
+				}
 				/* Emit last chunk for chunked messages only */
 				if (!chunk_memcat(&outbuf, "0\r\n", 3))
                                         goto full;