]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MINOR: qmux: do not crash on frame parsing issue
authorAmaury Denoyelle <adenoyelle@haproxy.com>
Tue, 26 May 2026 12:25:32 +0000 (14:25 +0200)
committerAmaury Denoyelle <adenoyelle@haproxy.com>
Tue, 26 May 2026 12:29:55 +0000 (14:29 +0200)
Ensure frame parsing error does not cause a crash by removing the
associated BUG_ON()/ABORT_NOW().

For now, connection is flagged on error, which ensures that any
send/receive future operations are prevented and connection is closed
asap. In the future, a proper CONNECTION_CLOSE will be required as
defined by QMux protocol.

No need to backport.

src/qcm_qmux.c

index 801ad3e1021a86fe71c5151500df087e1697debe..da55f1767b8479b75c0312674ec3448db757947c 100644 (file)
@@ -188,11 +188,10 @@ int qcc_qmux_recv(struct qcc *qcc)
                        buf_rec = b_make(b_orig(buf), b_size(buf),
                                         b_head_ofs(buf), qcc->rx.rlen);
                        frm_ret = qmux_parse_frm(qcc, &buf_rec);
-
-                       BUG_ON(frm_ret < 0); /* TODO handle fatal errors */
                        if (!frm_ret) {
-                               /* emit FRAME_ENCODING_ERROR */
-                               ABORT_NOW();
+                               /* TODO implement proper connection closure */
+                               conn->flags |= CO_FL_ERROR;
+                               goto out;
                        }
 
                        /* A frame cannot be bigger than a record thanks to <buf_rec> delimitation. */