From: Frederic Lecaille <flecaille@haproxy.com>
Date: Thu, 28 May 2026 05:54:32 +0000 (+0200)
Subject: BUG/MINOR: quic: fix ack range node pool_free call passing wrong pointer type
X-Git-Tag: v3.4.0~65
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=52ce3167866d7f29ebe773d6a6a5b21774ee29d4;p=thirdparty%2Fhaproxy.git

BUG/MINOR: quic: fix ack range node pool_free call passing wrong pointer type

In quic_insert_new_range(), the variable 'first' is a struct eb64_node*,
but pool_free expects a struct quic_arng_node*. While the addresses are identical
(since 'first' is the first member of quic_arng_node), this is technically
incorrect and should use eb64_entry() for proper type safety.

Must be backported to all versions.
---

diff --git a/src/quic_ack.c b/src/quic_ack.c
index bb6e5cfad..228283b6d 100644
--- a/src/quic_ack.c
+++ b/src/quic_ack.c
@@ -86,7 +86,7 @@ struct quic_arng_node *quic_insert_new_range(struct quic_conn *qc,
 		first = eb64_first(&arngs->root);
 		BUG_ON(first == NULL);
 		eb64_delete(first);
-		pool_free(pool_head_quic_arng, first);
+		pool_free(pool_head_quic_arng, eb64_entry(first, struct quic_arng_node, first));
 		arngs->sz--;
 	}