tree cbfd5687380dc8c94537ed85721e4c09c528f5d7
parent 0fa14a69e85d027acc43615a496a7576d1a707b7
author Amaury Denoyelle <adenoyelle@haproxy.com> 1651063313 +0200
committer Amaury Denoyelle <adenoyelle@haproxy.com> 1651151900 +0200

BUG/MEDIUM: h3: fix use-after-free on mux Rx buffer wrapping

Handle wrapping buffer in h3_data_to_htx(). If data is wrapping, first
copy the contiguous data, then copy the data in front of the buffer.

Note that h3_headers_to_htx() is not able to handle wrapping data. For
the moment, a BUG_ON was added as a reminder. This cas never happened,
most probably because HEADERS is the first frame of the stream.