From: Frederic Lecaille <flecaille@haproxy.com>
Date: Tue, 26 May 2026 09:26:23 +0000 (+0200)
Subject: BUG/MINOR: qpack: Fix index calculation in debug functions
X-Git-Tag: v3.4.0~84
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=40313cd0d5ca88af2e9cc8a11a25acd4ff9a62c9;p=thirdparty%2Fhaproxy.git

BUG/MINOR: qpack: Fix index calculation in debug functions

Although qpack_idx_to_name and qpack_idx_to_value are currently only
called within uncompiled debug code, they contained an index bug. They
passed absolute indexes directly to qpack_get_dte instead of relative
dynamic table indexes.

This patch fixes the logic by subtracting QPACK_SHT_SIZE and guarding
against static table index lookups.

Should be easily backported to all versions.
---

diff --git a/include/haproxy/qpack-tbl.h b/include/haproxy/qpack-tbl.h
index 05f3ab4c6..ef934f86b 100644
--- a/include/haproxy/qpack-tbl.h
+++ b/include/haproxy/qpack-tbl.h
@@ -93,24 +93,30 @@ static inline struct ist qpack_get_value(const struct qpack_dht *dht, const stru
 	return ret;
 }
 
-/* takes an idx, returns the associated name */
+/* takes an absolute idx (including static table offset), returns the associated name */
 static inline struct ist qpack_idx_to_name(const struct qpack_dht *dht, uint32_t idx)
 {
 	const struct qpack_dte *dte;
 
-	dte = qpack_get_dte(dht, idx);
+	if (idx < QPACK_SHT_SIZE)
+		return ist("### ERR ###"); /* static table entries not accessible via dht */
+
+	dte = qpack_get_dte(dht, idx - QPACK_SHT_SIZE);
 	if (!dte)
 		return ist("### ERR ###"); // error
 
 	return qpack_get_name(dht, dte);
 }
 
-/* takes an idx, returns the associated value */
+/* takes an absolute idx (including static table offset), returns the associated value */
 static inline struct ist qpack_idx_to_value(const struct qpack_dht *dht, uint32_t idx)
 {
 	const struct qpack_dte *dte;
 
-	dte = qpack_get_dte(dht, idx);
+	if (idx < QPACK_SHT_SIZE)
+		return ist("### ERR ###"); /* static table entries not accessible via dht */
+
+	dte = qpack_get_dte(dht, idx - QPACK_SHT_SIZE);
 	if (!dte)
 		return ist("### ERR ###"); // error