BUG/MINOR: mux-h2: properly ignore R bit in WINDOW_UPDATE increments

The window size increments are 31 bits and the topmost bit is reserved
and should be ignored, however it was not masked, so a peer sending it
set would emit a negative value which could actually reduce the current
window instead of increasing it. Note that the window cannot reach zero
as there's already a test for this, but transfers could slow down to
the same speed as if an initial window of just a few bytes had been
advertised. Let's just mask the reserved bit before processing.

This should be backported to all stable versions.

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 09606ca3918f483ea24b53c2352acf5aac2e7960..cc2f2522fdd4451f8a14b56903fb613efa2d203a 100644 (file)
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -3289,7 +3289,7 @@ static int h2c_handle_window_update(struct h2c *h2c, struct h2s *h2s)
                goto out0;
        }
 
-       inc = h2_get_n32(&h2c->dbuf, 0);
+       inc = h2_get_n32(&h2c->dbuf, 0) & 0x7FFFFFFF;
 
        if (h2c->dsi != 0) {
                /* stream window update */