From: Frédéric Lécaille <flecaille@haproxy.com>
Date: Tue, 15 Feb 2022 09:27:34 +0000 (+0100)
Subject: MINOR: quic: Possible frame parsers array overrun
X-Git-Tag: v2.6-dev2~131
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0c80e694709f9411f5eaf96f5b8bddcd1efd2972;p=thirdparty%2Fhaproxy.git

MINOR: quic: Possible frame parsers array overrun

This should fix CID 1469663 for GH #1546.
---

diff --git a/src/quic_frame.c b/src/quic_frame.c
index 721b5e02df..0adce4c1f7 100644
--- a/src/quic_frame.c
+++ b/src/quic_frame.c
@@ -1094,7 +1094,7 @@ int qc_parse_frm(struct quic_frame *frm, struct quic_rx_packet *pkt,
 	}
 
 	frm->type = *(*buf)++;
-	if (frm->type > QUIC_FT_MAX) {
+	if (frm->type >= QUIC_FT_MAX) {
 		TRACE_DEVEL("wrong frame type", QUIC_EV_CONN_PRSFRM, qc, frm);
 		return 0;
 	}