From: Olivier Houchard <ohouchard@haproxy.com>
Date: Tue, 25 Aug 2026 15:10:28 +0000 (+0200)
Subject: MEDIUM: mux-h2: don't report EOM on a short content-length message
X-Git-Tag: v3.5-dev6~76
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=f572cc242759e521f5f6425c9b9e73a3034ebabf;p=haproxy.git

MEDIUM: mux-h2: don't report EOM on a short content-length message

If we received an end of stream, but we ended up getting less than
Content-Length, then do not broadcast EOM, we never got the whole
message.
This is more hardening, to make sure everything is consistent across the
whole stream.

This should be backported up to 2.8.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 7704de822..92ababe06 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -6611,9 +6611,18 @@ try_again:
 		 * EOM was already reported.
 		 */
 		if ((h2c->flags & H2_CF_IS_BACK) || !(h2s->flags & H2_SF_TUNNEL_ABRT)) {
-			/* htx may be empty if receiving an empty DATA frame. */
-			if (!htx_set_eom(htx))
-				goto fail;
+			/*
+			 * Do not report end of message if we had a
+			 * Content-Length, but we got less than that, otherwise
+			 * the other mux will consider it complete when it
+			 * should not.
+			 */
+			if (!(h2s->flags & H2_SF_DATA_CLEN) || !h2s->body_len ||
+			    ((h2c->flags & H2_CF_IS_BACK) && (h2s->flags & H2_SF_BODYLESS_RESP))) {
+				/* htx may be empty if receiving an empty DATA frame. */
+				if (!htx_set_eom(htx))
+					goto fail;
+			}
 		}
 	}