]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MEDIUM: h3: fix trace crash on frontend response headers quic-interop flx04/quic-interop
authorAmaury Denoyelle <adenoyelle@haproxy.com>
Thu, 25 Jun 2026 14:06:16 +0000 (16:06 +0200)
committerAmaury Denoyelle <adenoyelle@haproxy.com>
Fri, 26 Jun 2026 09:32:10 +0000 (11:32 +0200)
Fix segfault when using HTTP/3 header traces on the frontend side. This
occured because headers list was dumped prior to the insertion of the
end marker.

This issue is introduced by the following patch :
  commit 00c081b5f388b655dd2c0fe5fdda8aacceb6b97e
  MINOR: h3: trace HTTP headers on FE side

No need to backport, unless HTTP/3 header traces are picked to previous
releases.

src/h3.c

index fddc845f91c9cef78e1fde783ad801750c34b3ea..e9501fb79b5e8a74c05e391fe94f778dea9911e2 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -2531,14 +2531,6 @@ static int h3_resp_headers_send(struct qcs *qcs, struct htx *htx)
                }
        }
 
-       if ((TRACE_SOURCE)->verbosity >= H3_VERB_ADVANCED &&
-           TRACE_ENABLED(TRACE_LEVEL_USER, H3_EV_TX_FRAME|H3_EV_TX_HDR, qcs->qcc->conn, 0, 0, 0)) {
-               int i;
-               for (i = 0; list[i].n.len; ++i)
-                       h3_trace_header(list[i].n, list[i].v, H3_EV_TX_HDR, ist(TRC_LOC), __FUNCTION__, qcs->qcc, qcs);
-       }
-
-
        /* Current function expects HTX start-line to be present. This also
         * ensures <status> conformance has been checked prior to encoding it.
         */
@@ -2546,6 +2538,13 @@ static int h3_resp_headers_send(struct qcs *qcs, struct htx *htx)
 
        list[hdr].n = ist("");
 
+       if ((TRACE_SOURCE)->verbosity >= H3_VERB_ADVANCED &&
+           TRACE_ENABLED(TRACE_LEVEL_USER, H3_EV_TX_FRAME|H3_EV_TX_HDR, qcs->qcc->conn, 0, 0, 0)) {
+               int i;
+               for (i = 0; list[i].n.len; ++i)
+                       h3_trace_header(list[i].n, list[i].v, H3_EV_TX_HDR, ist(TRC_LOC), __FUNCTION__, qcs->qcc, qcs);
+       }
+
  retry:
        res = smallbuf ? qcc_get_stream_txbuf(qcs, &err, 1) :
                         qcc_realloc_stream_txbuf(qcs);