From: Amaury Denoyelle Date: Wed, 18 Mar 2026 08:24:32 +0000 (+0100) Subject: [PATCH] BUG/MAJOR: h3: check body size with content-length on empty FIN X-Git-Tag: archive/raspbian/2.6.12-1+rpi1+deb12u4^2~3 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=ade9633ef7d2c70c75f187d8ffc061e91f77bd80;p=haproxy.git [PATCH] BUG/MAJOR: h3: check body size with content-length on empty FIN In QUIC, a STREAM frame may be received with no data but with FIN bit set. This situation is tedious to handle and haproxy parsing code has changed several times to deal with this situation. Now, H3 and H09 layers parsing code are skipped in favor of the shared function qcs_http_handle_standalone_fin() used to handle the HTX EOM emission. However, this shortcut bypasses an important HTTP/3 validation check on the received body size vs the announced content-length header. Under some conditions, this could cause a desynchronization with the backend server which could be exploited for request smuggling. Fix HTTP/3 parsing code by adding a call to h3_check_body_size() prior to qcs_http_handle_standalone_fin() if content-length header has been found. If the body size is incorrect, the stream is immediately resetted with H3_MESSAGE_ERROR code and the error is forwarded to the stream layer. Thanks to Martino Spagnuolo for his detailed report on this issue and for having contacting us about it via the security mailing list. This must be backported up to 2.6. (cherry picked from commit 05a295441c621089ffa4318daf0dbca2dd756a84) Signed-off-by: Amaury Denoyelle (cherry picked from commit 18e450ab412fb9397da36f226db8eed31ab590b6) Signed-off-by: Amaury Denoyelle (cherry picked from commit 7ab4ae974c434e62896b3c68b7b485b9dceb7a25) [ad: remove usage of qcs_http_handle_standalone_fin() introduced in 3.2] Signed-off-by: Amaury Denoyelle (cherry picked from commit ae54ad97c84cd6173f134c1f052a5375cf704f5c) Signed-off-by: Amaury Denoyelle (cherry picked from commit 425b969d6ea4114f4ae260f57802c65ccafc319c) [ad: adjust context due to non existent qcc_get_stream_rxbuf()] Signed-off-by: Amaury Denoyelle (cherry picked from commit ac75e1863c9dc965a9f7f9e87cdf8c22442ed9cd) [ad: context adjusted] Signed-off-by: Amaury Denoyelle Gbp-Pq: Name 0001-BUG-MAJOR-h3-check-body-size-with-content-length-on-.patch --- diff --git a/src/h3.c b/src/h3.c index 0e20f2c..624c79e 100644 --- a/src/h3.c +++ b/src/h3.c @@ -916,6 +916,12 @@ static ssize_t h3_decode_qcs(struct qcs *qcs, struct buffer *b, int fin) } if (!b_data(b) && fin && quic_stream_is_bidi(qcs->id)) { + /* FIN received, ensure body length is conform to any content-length header. */ + if ((h3s->flags & H3_SF_HAVE_CLEN) && h3_check_body_size(qcs, 1)) { + qcc_emit_cc_app(qcs->qcc, h3c->err, 1); + return -1; + } + qcs_http_handle_standalone_fin(qcs); return 0; }