tree 04b675257f4cb717a0b37be3f69c0b44d0cf8a0c
parent 2526a6aca5c6f453571f2ccdcea7e2ab66aeea67
author Frédéric Lécaille <flecaille@haproxy.com> 1669652505 +0100
committer Amaury Denoyelle <adenoyelle@haproxy.com> 1669731556 +0100

BUG/MINOR: quic: Endless loop during retransmissions

qc_dgrams_retransmit() could reuse the same local list and could splice it two
times to the packet number space list of frame to be send/resend. This creates a
loop in this list and makes qc_build_frms() possibly endlessly loop when trying
to build frames from the packet number space list of frames. Then haproxy aborts.

This issue could be easily reproduced patching qc_build_frms() function to set <dlen>
variable value to 0 after having built at least 10 CRYPTO frames and using ngtcp2
as client with 30% packet loss in both direction.

Thank you to @gabrieltz for having reported this issue in GH #1903.

Must be backported to 2.6.