From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 7 Jun 2022 16:24:34 +0000 (+0200)
Subject: BUG/MINOR: h3: fix return value on decode_qcs on error
X-Git-Tag: v2.7-dev1~92
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dca4c53a95f06124a3ae0cdd0343763541948b92;p=thirdparty%2Fhaproxy.git

BUG/MINOR: h3: fix return value on decode_qcs on error

Convert return code to -1 when an error has been detected. This is
required since the previous API change on return value from the patch :

  1f21ebdd7686bf435682cacd31e635db0c65b061
  MINOR: mux-quic/h3: adjust demuxing function return values

Without this, QUIC MUX won't consider the call as an error and will try
to remove one byte from the buffer. This may cause a BUG_ON failure if
the buffer is empty at this stage.

This bug was introduced in the current dev tree. Does not need to be
backported.
---

diff --git a/src/h3.c b/src/h3.c
index cbf12e4a72..96c1b0e2d7 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -614,7 +614,7 @@ static ssize_t h3_decode_qcs(struct qcs *qcs, struct buffer *b, int fin)
 
 			if (!h3_is_frame_valid(h3c, qcs, ftype)) {
 				qcc_emit_cc_app(qcs->qcc, H3_FRAME_UNEXPECTED);
-				return 1;
+				return -1;
 			}
 
 			if (!b_data(b))
@@ -636,7 +636,7 @@ static ssize_t h3_decode_qcs(struct qcs *qcs, struct buffer *b, int fin)
 			 */
 			if (flen > QC_S_RX_BUF_SZ) {
 				qcc_emit_cc_app(qcs->qcc, H3_EXCESSIVE_LOAD);
-				return 1;
+				return -1;
 			}
 			break;
 		}
@@ -666,7 +666,7 @@ static ssize_t h3_decode_qcs(struct qcs *qcs, struct buffer *b, int fin)
 			ret = h3_parse_settings_frm(qcs->qcc->ctx, b, flen);
 			if (ret < 0) {
 				qcc_emit_cc_app(qcs->qcc, h3c->err);
-				return 1;
+				return -1;
 			}
 			h3c->flags |= H3_CF_SETTINGS_RECV;
 			break;