From 8e0c2599b6f3e4da0cba4e870beae672cb851f09 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Tue, 17 Feb 2026 15:56:19 +0100 Subject: [PATCH] BUG/MEDIUM: mux-h1: Stop sending vi fast-forward for unexpected states If a producer tries to send data via the fast-forward mechanism while the message is in an unexpected state from the consumer point of view, the fast-forward is now disabled. Concretely, we now take care that the message is in its data/tunnel stage to proceed in h1_nego_ff(). By disabling fast-forward in that case, we will automatically fall back on the regular sending path and be able to handle the error in h1_snd_buf(). This patch should be backported as far as 3.0 --- src/mux_h1.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/mux_h1.c b/src/mux_h1.c index 232c9c184..81bd071ba 100644 --- a/src/mux_h1.c +++ b/src/mux_h1.c @@ -4937,6 +4937,12 @@ static size_t h1_nego_ff(struct stconn *sc, struct buffer *input, size_t count, goto out; } + if (h1m->state < H1_MSG_CHUNK_SIZE || h1m->state == H1_MSG_TRAILERS || h1m->state == H1_MSG_DONE) { + TRACE_STATE("Unexpected message state, disable fastfwd", H1_EV_STRM_SEND|H1_EV_STRM_ERR, h1c->conn, h1s); + h1s->sd->iobuf.flags |= IOBUF_FL_NO_FF; + goto out; + } + if ((!(h1m->flags & H1_MF_RESP) && (h1s->flags & H1S_F_BODYLESS_REQ)) || ((h1m->flags & H1_MF_RESP) && (h1s->flags & H1S_F_BODYLESS_RESP))) { TRACE_STATE("Bodyless message, disable fastfwd", H1_EV_STRM_SEND|H1_EV_STRM_ERR, h1c->conn, h1s);