From 40313cd0d5ca88af2e9cc8a11a25acd4ff9a62c9 Mon Sep 17 00:00:00 2001 From: Frederic Lecaille Date: Tue, 26 May 2026 11:26:23 +0200 Subject: [PATCH] BUG/MINOR: qpack: Fix index calculation in debug functions Although qpack_idx_to_name and qpack_idx_to_value are currently only called within uncompiled debug code, they contained an index bug. They passed absolute indexes directly to qpack_get_dte instead of relative dynamic table indexes. This patch fixes the logic by subtracting QPACK_SHT_SIZE and guarding against static table index lookups. Should be easily backported to all versions. --- include/haproxy/qpack-tbl.h | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/include/haproxy/qpack-tbl.h b/include/haproxy/qpack-tbl.h index 05f3ab4c6..ef934f86b 100644 --- a/include/haproxy/qpack-tbl.h +++ b/include/haproxy/qpack-tbl.h @@ -93,24 +93,30 @@ static inline struct ist qpack_get_value(const struct qpack_dht *dht, const stru return ret; } -/* takes an idx, returns the associated name */ +/* takes an absolute idx (including static table offset), returns the associated name */ static inline struct ist qpack_idx_to_name(const struct qpack_dht *dht, uint32_t idx) { const struct qpack_dte *dte; - dte = qpack_get_dte(dht, idx); + if (idx < QPACK_SHT_SIZE) + return ist("### ERR ###"); /* static table entries not accessible via dht */ + + dte = qpack_get_dte(dht, idx - QPACK_SHT_SIZE); if (!dte) return ist("### ERR ###"); // error return qpack_get_name(dht, dte); } -/* takes an idx, returns the associated value */ +/* takes an absolute idx (including static table offset), returns the associated value */ static inline struct ist qpack_idx_to_value(const struct qpack_dht *dht, uint32_t idx) { const struct qpack_dte *dte; - dte = qpack_get_dte(dht, idx); + if (idx < QPACK_SHT_SIZE) + return ist("### ERR ###"); /* static table entries not accessible via dht */ + + dte = qpack_get_dte(dht, idx - QPACK_SHT_SIZE); if (!dte) return ist("### ERR ###"); // error