From: Olivier Houchard <ohouchard@haproxy.com>
Date: Thu, 28 May 2026 20:01:01 +0000 (+0200)
Subject: BUG/MEDIUM: qmux: Close connection on invalid frame
X-Git-Tag: v3.4.0~38
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=bda42604c0c27c5b8b8b26bd69c470014b04506e;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: qmux: Close connection on invalid frame

In qcc_qmux_recv(), when calling qmux_parse_frm(), also treat negative
values as an error, and close the connexion. qmux_parse_frm() will
return -1 if the frame is of an invalid type, and we don't want to
process any further, or we will crash.
---

diff --git a/src/qcm_qmux.c b/src/qcm_qmux.c
index aa2cb6a91..4491fb726 100644
--- a/src/qcm_qmux.c
+++ b/src/qcm_qmux.c
@@ -195,7 +195,7 @@ int qcc_qmux_recv(struct qcc *qcc)
 			buf_rec = b_make(b_orig(buf), b_size(buf),
 			                 b_head_ofs(buf), qcc->rx.rlen);
 			frm_ret = qmux_parse_frm(qcc, &buf_rec);
-			if (!frm_ret) {
+			if (frm_ret <= 0) {
 				/* TODO implement proper connection closure */
 				conn->flags |= CO_FL_ERROR;
 				goto out;