From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Thu, 24 Sep 2026 16:06:02 +0000 (+0200)
Subject: BUG/MINOR: h3: reject frames with truncated header
X-Git-Tag: v3.5-dev9~177
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=95dd2448b185309edfe2d3918cc9c91b159ae2a5;p=haproxy.git

BUG/MINOR: h3: reject frames with truncated header

The following patch ensures that H3 frames with a truncated payload are
now properly rejected with H3_FRAME_ERROR.

  86a4ebc761a278838e8cb06f3a292282ba704c65
  BUG/MAJOR: h3: reject H3 truncated frames

However, this fix is not complete as it did not detect H3 frame
truncated at the header boundary. This happens when one of the two
fields varint cannot be decoded and FIN is reported as well.

This patch corrects this by reporting a connection error H3_FRAME_ERROR
in this condition. This allows to quickly teardown the connection
instead of waiting for the stream timeout without any error.

This must be backported to all stable releases.
---

diff --git a/src/h3.c b/src/h3.c
index 2768c779a..c0d310d96 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -1984,6 +1984,13 @@ static ssize_t h3_rcv_buf(struct qcs *qcs, struct buffer *b, int fin)
 			/* Switch to a new frame. */
 			size_t hlen = h3_decode_frm_header(&ftype, &flen, b);
 			if (!hlen) {
+				if (fin) {
+					TRACE_ERROR("truncated H3 frame header", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
+					qcc_set_error(qcs->qcc, H3_ERR_FRAME_ERROR, 1, muxc_tevt_type_proto_err);
+					qcc_report_glitch(qcs->qcc, 1);
+					goto err;
+				}
+
 				TRACE_PROTO("pause parsing on incomplete frame header", H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
 				break;
 			}