From 745b120866151add3a56d310535984e5da4aefcc Mon Sep 17 00:00:00 2001 From: Amaury Denoyelle Date: Mon, 19 Oct 2026 14:01:12 +0200 Subject: [PATCH] BUG/MINOR: h3: fix risk of BUG_ON() crash with glitch on unknown frame The following patch extend parsing for HTTP/3 unknown frame type with FIN set to ensure that closure is notified to the upper layer. fe1da6850ab3e89e242c1d8d53ef17a1ba1dee6b BUG/MINOR: h3: handle unknown frame type on request stream as specified The first objective is to report a stream error if the stream is closed without any request seen. However, this case does not prevent to report an HTX EOM which is unnecessary. Worst, it could cause a crash if EOM fails due to an internal error, as qcc_set_error() could be called a second times after glitch reporting. Fix both issues by interrupting parsing as soon as the stream level error is set. This must be backported up to 3.0. --- src/h3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/h3.c b/src/h3.c index b4946fbc6..fcca8c45e 100644 --- a/src/h3.c +++ b/src/h3.c @@ -2250,6 +2250,7 @@ static ssize_t h3_rcv_buf(struct qcs *qcs, struct buffer *b, int fin) h3s->err = H3_ERR_MESSAGE_ERROR; qcc_report_glitch(qcs->qcc, 1); ret = -1; + break; } /* Reuse wrapper function to easily set EOM on HTX message. */ -- 2.47.3