]> git.kaiwu.me - haproxy.git/commit
BUG/MINOR: xprt_qstrm: reduce max record length check
authorAmaury Denoyelle <adenoyelle@haproxy.com>
Mon, 20 Apr 2026 07:21:08 +0000 (09:21 +0200)
committerAmaury Denoyelle <adenoyelle@haproxy.com>
Mon, 20 Apr 2026 08:21:30 +0000 (10:21 +0200)
commit1f435f031b80d04e82f70a8fdf814decf77a9f7e
tree870e34f1ea6e3452a6609eb3dabacd9b952d351d
parentbee81dc53cd7ab4b4a9ab08326814a4cc372758a
BUG/MINOR: xprt_qstrm: reduce max record length check

When trying to read QMux transport parameters frame, the record length
is checked to ensure it is not bigger than the buffer size. The
objective is to detect as soon as possible when receiving data that
cannot be handled and to close the connection.

In fact, this check is not accurate, as it did not take into account the
size of the Record length field itself. This patch fixes the comparison
by substracting with the size of the decoded varint.

No need to backport.
src/xprt_qstrm.c