From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Wed, 27 May 2026 13:34:01 +0000 (+0200)
Subject: BUG/MINOR: qmux: reject too large initial record
X-Git-Tag: v3.4.0~86
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=cd652efecab08ce6a10240456635c326cc22e0ea;p=thirdparty%2Fhaproxy.git

BUG/MINOR: qmux: reject too large initial record

Initial max_record_size is set to 16382. If the first received record
size is larger, abort xprt_qmux layer immediately without having to wait
for the timeout.

No need to backport.
---

diff --git a/src/xprt_qmux.c b/src/xprt_qmux.c
index e544f559a..1fdbcd88b 100644
--- a/src/xprt_qmux.c
+++ b/src/xprt_qmux.c
@@ -97,6 +97,10 @@ int conn_recv_qmux(struct connection *conn, struct xprt_qmux_ctx *ctx, int flag)
 		ctx->rxrlen = rlen;
 	}
 
+	/* TODO initial max_record_size is limited to 16382 */
+	if (ctx->rxrlen > b_size(buf))
+		goto fail;
+
 	if (ctx->rxrlen > b_data(buf))
 		goto not_ready;