tree e785afd1f1f6c527ce4aa6119d39f4eeb6f6be11
parent 88d5dd1a6f4c48db667c3cc7de8dd5110af5409d
author Amaury Denoyelle <adenoyelle@haproxy.com> 1653999513 +0200
committer Amaury Denoyelle <adenoyelle@haproxy.com> 1654001151 +0200

BUG/MEDIUM: h3: fix H3_EXCESSIVE_LOAD when receiving H3 frame header only

The H3 frame demuxing code is incorrect when receiving a STREAM frame
which contains only a new H3 frame header without its payload.

In this case, the check on frames bigger than the buffer size is
incorrect. This is because the buffer has been freed via
qcs_consume()/qc_free_ncbuf() as it was emptied after H3 frame header
parsing. This causes the connection to be incorrectly closed with
H3_EXCESSIVE_LOAD error.

This bug was reproduced with xquic client on the interop and with the
command-line invocation :

$ ./interop_client -l d -k $SSLKEYLOGFILE -a <addr> -p <port> -D /tmp \
    -A h3 -U https://<addr>:<port>/hello_world.txt

Note also that h3_is_frame_valid() invocation has been moved before the
new buffer size check. This ensures that first we check the frame
validity before returning from the function. It's also better
positionned as this is only needed when a new H3 frame header has been
parsed.