From f7130c0f3673d79b2c740fc4b0abbfb400fae1f5 Mon Sep 17 00:00:00 2001 From: Amaury Denoyelle Date: Tue, 26 May 2026 14:06:23 +0200 Subject: [PATCH] BUG/MINOR: h3: add missing break on rcv_buf() The following patch ensures server MAX_PUSH_ID are rejected as a client. This has been implemented by extending h3_rcv_buf(). e4a5a64198bb084eaef2e71bfde65704a5db3931 BUG/MINOR: h3: reject server MAX_PUSH_ID frame Case label for MAX_PUSH_ID has been moved in the function, however the break instruction was removed by error. Fix this by adding the missing break statement. This must be backported to every version the above fix is. Currently, it is scheduled to 3.3. --- src/h3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/h3.c b/src/h3.c index 6d58d9f99..5a792c02b 100644 --- a/src/h3.c +++ b/src/h3.c @@ -2020,6 +2020,7 @@ static ssize_t h3_rcv_buf(struct qcs *qcs, struct buffer *b, int fin) * the client has advertised as a connection error of H3_ID_ERROR. */ ret = H3_ERR_ID_ERROR; + break; case H3_FT_MAX_PUSH_ID: /* h3_check_frame_valid() must reject on client side. */ BUG_ON(conn_is_back(qcs->qcc->conn));