From: Frederic Lecaille <flecaille@haproxy.com>
Date: Fri, 26 Jun 2026 14:51:52 +0000 (+0200)
Subject: BUG/MEDIUM: mux_quic: fix memory leak of rx app_buf on stream free
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1cb254ad77923d205900ccdc866434977be292ff;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux_quic: fix memory leak of rx app_buf on stream free

When freeing a QUIC stream (qcs), the receive application buffer
(qcs->rx.app_buf) was not released if it still contained data or
had been allocated. This led to a memory leak over time as streams
were opened and closed.

Fix this by explicitly freeing qcs->rx.app_buf via b_free() in
qcs_free() if its size is non-zero, and call offer_buffers() to
notify the buffer pool.

This should be backported as far as 2.6.
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index c8a880450..bfed86c4b 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -127,6 +127,11 @@ static void qcs_free(struct qcs *qcs)
 		qcs_free_rxbuf(qcs, b);
 	}
 
+	if (b_size(&qcs->rx.app_buf)) {
+		b_free(&qcs->rx.app_buf);
+		offer_buffers(NULL, 1);
+	}
+
 	/* Remove qcs from qcc tree. */
 	eb64_delete(&qcs->by_id);