From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 26 May 2026 12:06:23 +0000 (+0200)
Subject: BUG/MINOR: h3: add missing break on rcv_buf()
X-Git-Tag: v3.4-dev14~13
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=f7130c0f3673d79b2c740fc4b0abbfb400fae1f5;p=thirdparty%2Fhaproxy.git

BUG/MINOR: h3: add missing break on rcv_buf()

The following patch ensures server MAX_PUSH_ID are rejected as a client.
This has been implemented by extending h3_rcv_buf().

  e4a5a64198bb084eaef2e71bfde65704a5db3931
  BUG/MINOR: h3: reject server MAX_PUSH_ID frame

Case label for MAX_PUSH_ID has been moved in the function, however the
break instruction was removed by error. Fix this by adding the missing
break statement.

This must be backported to every version the above fix is. Currently, it
is scheduled to 3.3.
---

diff --git a/src/h3.c b/src/h3.c
index 6d58d9f99..5a792c02b 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -2020,6 +2020,7 @@ static ssize_t h3_rcv_buf(struct qcs *qcs, struct buffer *b, int fin)
 			 * the client has advertised as a connection error of H3_ID_ERROR.
 			 */
 			ret = H3_ERR_ID_ERROR;
+			break;
 		case H3_FT_MAX_PUSH_ID:
 			/* h3_check_frame_valid() must reject on client side. */
 			BUG_ON(conn_is_back(qcs->qcc->conn));