tree 615c88f3e8548dd412a714a4deba0ce2961bbe7c
parent 156a89aef8c63910502b266251dc34f648a99fae
author Amaury Denoyelle <adenoyelle@haproxy.com> 1674745425 +0100
committer Amaury Denoyelle <adenoyelle@haproxy.com> 1676888109 +0100

BUG/MINOR: h3: prevent hypothetical demux failure on int overflow

h3s stores the current demux frame type and length as a state info. It
should be big enough to store a QUIC variable-length integer which is
the maximum H3 frame type and size.

Without this patch, there is a risk of integer overflow if H3 frame size
is bigger than INT_MAX. This can typically causes demux state mismatch
and demux frame error. However, no occurence has been found yet of this
bug with the current implementation.

This should be backported up to 2.6.