From fc9a503b1413d5e38f561a3ce324f35db027192b Mon Sep 17 00:00:00 2001 From: Amaury Denoyelle Date: Mon, 19 Oct 2026 13:19:49 +0200 Subject: [PATCH] BUG/MEDIUM: h3: fix BUG_ON() crash with glitch on GOAWAY parsing This patch fixes glitch reporting after GOAWAY frame parsing. Similar to the previous commit, qcc_report_glitch() is called only after qcc_set_error() after h3_parse_goaway_frm(). This must be backported up to 3.4. --- src/h3.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/h3.c b/src/h3.c index 5481aaa94..566819ad3 100644 --- a/src/h3.c +++ b/src/h3.c @@ -1848,20 +1848,17 @@ static ssize_t h3_parse_goaway_frm(struct h3c *h3c, const struct buffer *buf, */ TRACE_ERROR("truncated GOAWAY frame", H3_EV_RX_FRAME, h3c->qcc->conn); h3c->err = H3_ERR_FRAME_ERROR; - qcc_report_glitch(h3c->qcc, 1); return -1; } if (ret != len) { TRACE_ERROR("mismatch on GOAWAY frame length", H3_EV_RX_FRAME, h3c->qcc->conn); h3c->err = H3_ERR_FRAME_ERROR; - qcc_report_glitch(h3c->qcc, 1); return -1; } if ((h3c->flags & H3_CF_GOAWAY_RECV) && id > h3c->id_shut_r) { h3c->err = H3_ERR_ID_ERROR; - qcc_report_glitch(h3c->qcc, 1); return -1; } @@ -2180,6 +2177,7 @@ static ssize_t h3_rcv_buf(struct qcs *qcs, struct buffer *b, int fin) if (ret < 0) { TRACE_ERROR("error on GOAWAY parsing", H3_EV_RX_FRAME, qcs->qcc->conn, qcs); qcc_set_error(qcs->qcc, h3c->err, 1, muxc_tevt_type_proto_err); + qcc_report_glitch(h3c->qcc, 1); goto err; } break; -- 2.47.3