From fbd7148b15672da1afbed884fe5d140ebd5d25e9 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Thu, 28 May 2026 14:42:16 +0200 Subject: [PATCH] BUG/MINOR: mux-h2: Count padding for connection flow control on error path When DATA frame are received, we take care to update the counter used to send WINDOW_UPDATE for the connection. It is also performed on error path when DATA frames are processed. However, when this happened, only the frame length was accounted while the padding must also be considered. To fix the issue, the full frame length (h2c->dfl), which include the padding length, must be added to the amount of newly received data (h2c->rcvd_c). The issue was introduced with commit eeacca75d ("BUG/MINOR: mux-h2: count rejected DATA frames against the connection's flow control") and backported to 2.8. So this patch must be backported as far as 2.8. --- src/mux_h2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/mux_h2.c b/src/mux_h2.c index 7546e04a6..8897ee373 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -4007,7 +4007,7 @@ static int h2c_handle_data(struct h2c *h2c, struct h2s *h2s) * going to kill the stream but must still update the connection's * window. */ - h2c->rcvd_c += h2c->dfl - h2c->dpl; + h2c->rcvd_c += h2c->dfl; strm_err: h2s_error(h2s, error); h2c->st0 = H2_CS_FRAME_E; @@ -4128,7 +4128,7 @@ static int h2_frame_check_vs_state(struct h2c *h2c, struct h2s *h2s) /* even if we reject out-of-stream DATA, it must * still count against the connection's flow control. */ - h2c->rcvd_c += h2c->dfl - h2c->dpl; + h2c->rcvd_c += h2c->dfl; } h2c_report_glitch(h2c, 1, "invalid frame type after receiving RST_STREAM");