From: Frédéric Lécaille <flecaille@haproxy.com>
Date: Tue, 21 Dec 2021 13:48:58 +0000 (+0100)
Subject: MINOR: quic: unchecked qc_retrieve_conn_from_cid() returned value
X-Git-Tag: v2.6-dev1~239
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4d118d6a8e90526179a7c1072951766c215d94f2;p=thirdparty%2Fhaproxy.git

MINOR: quic: unchecked qc_retrieve_conn_from_cid() returned value

If qc_retrieve_conn_from_cid() did not manage to retrieve the connection
from packet CIDs, we must drop them.
---

diff --git a/src/xprt_quic.c b/src/xprt_quic.c
index ee609753f2..e87124412c 100644
--- a/src/xprt_quic.c
+++ b/src/xprt_quic.c
@@ -4117,6 +4117,12 @@ static ssize_t qc_lstnr_pkt_rcv(unsigned char **buf, const unsigned char *end,
 		*buf += QUIC_HAP_CID_LEN;
 
 		qc = qc_retrieve_conn_from_cid(pkt, l, saddr);
+		if (!qc) {
+			size_t pktlen = end - *buf;
+			TRACE_PROTO("Packet dropped", QUIC_EV_CONN_LPKT, NULL, pkt, &pktlen);
+			goto err;
+		}
+
 		if (HA_ATOMIC_LOAD(&qc->conn))
 			conn_ctx = HA_ATOMIC_LOAD(&qc->conn->xprt_ctx);