From dca4c53a95f06124a3ae0cdd0343763541948b92 Mon Sep 17 00:00:00 2001 From: Amaury Denoyelle Date: Tue, 7 Jun 2022 18:24:34 +0200 Subject: [PATCH] BUG/MINOR: h3: fix return value on decode_qcs on error Convert return code to -1 when an error has been detected. This is required since the previous API change on return value from the patch : 1f21ebdd7686bf435682cacd31e635db0c65b061 MINOR: mux-quic/h3: adjust demuxing function return values Without this, QUIC MUX won't consider the call as an error and will try to remove one byte from the buffer. This may cause a BUG_ON failure if the buffer is empty at this stage. This bug was introduced in the current dev tree. Does not need to be backported. --- src/h3.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/h3.c b/src/h3.c index cbf12e4..96c1b0e 100644 --- a/src/h3.c +++ b/src/h3.c @@ -614,7 +614,7 @@ static ssize_t h3_decode_qcs(struct qcs *qcs, struct buffer *b, int fin) if (!h3_is_frame_valid(h3c, qcs, ftype)) { qcc_emit_cc_app(qcs->qcc, H3_FRAME_UNEXPECTED); - return 1; + return -1; } if (!b_data(b)) @@ -636,7 +636,7 @@ static ssize_t h3_decode_qcs(struct qcs *qcs, struct buffer *b, int fin) */ if (flen > QC_S_RX_BUF_SZ) { qcc_emit_cc_app(qcs->qcc, H3_EXCESSIVE_LOAD); - return 1; + return -1; } break; } @@ -666,7 +666,7 @@ static ssize_t h3_decode_qcs(struct qcs *qcs, struct buffer *b, int fin) ret = h3_parse_settings_frm(qcs->qcc->ctx, b, flen); if (ret < 0) { qcc_emit_cc_app(qcs->qcc, h3c->err); - return 1; + return -1; } h3c->flags |= H3_CF_SETTINGS_RECV; break; -- 1.7.10.4