From: Christopher Faulet <cfaulet@haproxy.com>
Date: Thu, 28 May 2026 12:42:16 +0000 (+0200)
Subject: BUG/MINOR: mux-h2: Count padding for connection flow control on error path
X-Git-Tag: v3.4.0~73
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=fbd7148b15672da1afbed884fe5d140ebd5d25e9;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-h2: Count padding for connection flow control on error path

When DATA frame are received, we take care to update the counter used to
send WINDOW_UPDATE for the connection. It is also performed on error path
when DATA frames are processed. However, when this happened, only the frame
length was accounted while the padding must also be considered.

To fix the issue, the full frame length (h2c->dfl), which include the
padding length, must be added to the amount of newly received data
(h2c->rcvd_c).

The issue was introduced with commit eeacca75d ("BUG/MINOR: mux-h2: count
rejected DATA frames against the connection's flow control") and backported
to 2.8.

So this patch must be backported as far as 2.8.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 7546e04a6..8897ee373 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -4007,7 +4007,7 @@ static int h2c_handle_data(struct h2c *h2c, struct h2s *h2s)
 	 * going to kill the stream but must still update the connection's
 	 * window.
 	 */
-	h2c->rcvd_c += h2c->dfl - h2c->dpl;
+	h2c->rcvd_c += h2c->dfl;
  strm_err:
 	h2s_error(h2s, error);
 	h2c->st0 = H2_CS_FRAME_E;
@@ -4128,7 +4128,7 @@ static int h2_frame_check_vs_state(struct h2c *h2c, struct h2s *h2s)
 				/* even if we reject out-of-stream DATA, it must
 				 * still count against the connection's flow control.
 				 */
-				h2c->rcvd_c += h2c->dfl - h2c->dpl;
+				h2c->rcvd_c += h2c->dfl;
 			}
 
 			h2c_report_glitch(h2c, 1, "invalid frame type after receiving RST_STREAM");