From bda42604c0c27c5b8b8b26bd69c470014b04506e Mon Sep 17 00:00:00 2001 From: Olivier Houchard Date: Thu, 28 May 2026 22:01:01 +0200 Subject: [PATCH] BUG/MEDIUM: qmux: Close connection on invalid frame In qcc_qmux_recv(), when calling qmux_parse_frm(), also treat negative values as an error, and close the connexion. qmux_parse_frm() will return -1 if the frame is of an invalid type, and we don't want to process any further, or we will crash. --- src/qcm_qmux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qcm_qmux.c b/src/qcm_qmux.c index aa2cb6a91..4491fb726 100644 --- a/src/qcm_qmux.c +++ b/src/qcm_qmux.c @@ -195,7 +195,7 @@ int qcc_qmux_recv(struct qcc *qcc) buf_rec = b_make(b_orig(buf), b_size(buf), b_head_ofs(buf), qcc->rx.rlen); frm_ret = qmux_parse_frm(qcc, &buf_rec); - if (!frm_ret) { + if (frm_ret <= 0) { /* TODO implement proper connection closure */ conn->flags |= CO_FL_ERROR; goto out;