From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 29 Sep 2026 09:49:13 +0000 (+0200)
Subject: BUG/MINOR: mux_quic: extend FINAL_SIZE_ERROR detection on stream
X-Git-Tag: v3.5-dev9~181
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=b5fde1e57458bd0790f8c84c595ae76663e762fe;p=haproxy.git

BUG/MINOR: mux_quic: extend FINAL_SIZE_ERROR detection on stream

On STREAM reception, a frame is rejected if final size is known but a
frame which exceeds it is received. Connection is closed with
FINAL_SIZE_ERROR code. This is also the case for a frame with FIN set
but shorter than the already received maximum offset.

This patch rewrites the condition so that the second check on frame with
FIN is always performed. Indeed, it does not depend on the known final
size status. A similar test is already performed as expected in the
RESET_STREAM frame handler.

This must be backported up to 2.6.
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index 720ef9370..b9ae11551 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -2002,8 +2002,8 @@ int qcc_recv(struct qcc *qcc, uint64_t id, uint64_t len, uint64_t offset,
 	 * of type FINAL_SIZE_ERROR; see Section 11 for details on error
 	 * handling.
 	 */
-	if (qcs->flags & QC_SF_SIZE_KNOWN &&
-	    (offset + len > qcs->rx.offset_max || (fin && offset + len < qcs->rx.offset_max))) {
+	if (((qcs->flags & QC_SF_SIZE_KNOWN) && offset + len > qcs->rx.offset_max) ||
+	    (fin && offset + len < qcs->rx.offset_max)) {
 		TRACE_ERROR("final size error", QMUX_EV_QCC_RECV|QMUX_EV_QCS_RECV|QMUX_EV_PROTO_ERR, qcc->conn, qcs);
 		qcc_set_error(qcc, QC_ERR_FINAL_SIZE_ERROR, 0,
 		              muxc_tevt_type_proto_err);