From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Thu, 25 Jun 2026 14:06:16 +0000 (+0200)
Subject: BUG/MEDIUM: h3: fix trace crash on frontend response headers
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=09172169bcd0fe55831f0243d39dc81b98fbb0b9;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: h3: fix trace crash on frontend response headers

Fix segfault when using HTTP/3 header traces on the frontend side. This
occured because headers list was dumped prior to the insertion of the
end marker.

This issue is introduced by the following patch :
  commit 00c081b5f388b655dd2c0fe5fdda8aacceb6b97e
  MINOR: h3: trace HTTP headers on FE side

No need to backport, unless HTTP/3 header traces are picked to previous
releases.
---

diff --git a/src/h3.c b/src/h3.c
index fddc845f9..e9501fb79 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -2531,14 +2531,6 @@ static int h3_resp_headers_send(struct qcs *qcs, struct htx *htx)
 		}
 	}
 
-	if ((TRACE_SOURCE)->verbosity >= H3_VERB_ADVANCED &&
-	    TRACE_ENABLED(TRACE_LEVEL_USER, H3_EV_TX_FRAME|H3_EV_TX_HDR, qcs->qcc->conn, 0, 0, 0)) {
-		int i;
-		for (i = 0; list[i].n.len; ++i)
-			h3_trace_header(list[i].n, list[i].v, H3_EV_TX_HDR, ist(TRC_LOC), __FUNCTION__, qcs->qcc, qcs);
-	}
-
-
 	/* Current function expects HTX start-line to be present. This also
 	 * ensures <status> conformance has been checked prior to encoding it.
 	 */
@@ -2546,6 +2538,13 @@ static int h3_resp_headers_send(struct qcs *qcs, struct htx *htx)
 
 	list[hdr].n = ist("");
 
+	if ((TRACE_SOURCE)->verbosity >= H3_VERB_ADVANCED &&
+	    TRACE_ENABLED(TRACE_LEVEL_USER, H3_EV_TX_FRAME|H3_EV_TX_HDR, qcs->qcc->conn, 0, 0, 0)) {
+		int i;
+		for (i = 0; list[i].n.len; ++i)
+			h3_trace_header(list[i].n, list[i].v, H3_EV_TX_HDR, ist(TRC_LOC), __FUNCTION__, qcs->qcc, qcs);
+	}
+
  retry:
 	res = smallbuf ? qcc_get_stream_txbuf(qcs, &err, 1) :
 	                 qcc_realloc_stream_txbuf(qcs);