From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Wed, 23 Apr 2025 15:27:24 +0000 (+0200)
Subject: BUG/MINOR: mux-quic: fix possible infinite loop during decoding
X-Git-Tag: v3.2-dev12~26
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fbedb8746f2c525b6be1de5e9634fd7d4d2a8cb3;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-quic: fix possible infinite loop during decoding

With the support of multiple Rx buffers per QCS instance, stream
decoding in qcc_io_recv() has been reworked for the next haproxy
release. An issue appears in a double while loop : a break statement is
used in the inner loop, which is not sufficient as it should instead
exit from the outer one.

Fix this by replacing break with a goto statement.

No need to backport this.
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index 58733a556..000113645 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -2952,10 +2952,11 @@ static int qcc_io_recv(struct qcc *qcc)
 			LIST_DEL_INIT(&qcs->el_recv);
 
 			if (ret <= 0)
-				break;
+				goto done;
 		}
 	}
 
+ done:
 	TRACE_LEAVE(QMUX_EV_QCC_RECV, qcc->conn);
 	return 0;
 }