From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 20 Oct 2026 09:45:19 +0000 (+0200)
Subject: BUG/MINOR: h3: enforce maxrewrite on request headers
X-Git-Tag: v3.5-dev10~100
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=b5b5c7521689288fd40547d65f95871865e78a7f;p=haproxy.git

BUG/MINOR: h3: enforce maxrewrite on request headers

Muxes are responsible to ensure that at least maxrewrite space remains
in the stream buffer after headers decoding. This was missing in HTTP/3
decoder.

Add an extra check on maxrewrite size after H3 HEADERS request decoding.
The connection is closed with INTERNAL_ERROR if on excess. A future
patch may implement stream-level error instead.

This should be backported up to 2.6.
---

diff --git a/src/h3.c b/src/h3.c
index 9ec89e750..ed6463374 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -1174,6 +1174,13 @@ static ssize_t h3_req_headers_to_htx(struct qcs *qcs, const struct buffer *buf,
 	if (fin)
 		htx_set_eom(htx);
 
+	/* Check that at least reserved space remains after headers decoding. */
+	if (htx_free_space(htx) < global.tune.maxrewrite) {
+		/* TODO should be a stream level error instead of a connection one. */
+		len = -1;
+		goto out;
+	}
+
 	htx_to_buf(htx, &htx_buf);
 	htx = NULL;