Hello, On Sat, Sep 27, 2025 at 03:23:02PM +0000, PR Bot wrote: > Dear list! > > Author: zhanhb <[email protected]> > Number of patches: 1 > > This is an automated relay of the Github pull request: > BUG/MINOR: h2: h3: fix upper character testing > > Patch title(s): > BUG/MINOR: h2: h3: fix upper character testing > > Link: > https://github.com/haproxy/haproxy/pull/3140 (...)
> From 4c22a042a324c179f359d945af8e676bc7c681dc Mon Sep 17 00:00:00 2001 > From: zhanhb <[email protected]> > Date: Sat, 27 Sep 2025 23:01:32 +0800 > Subject: [PATCH] BUG/MINOR: h2: h3: fix upper character testing > > --- > src/h2.c | 6 +++--- > src/h3.c | 4 ++-- > 2 files changed, 5 insertions(+), 5 deletions(-) > > diff --git a/src/h2.c b/src/h2.c > index 491f62323c25c..9cc006ea938a6 100644 > --- a/src/h2.c > +++ b/src/h2.c > @@ -349,7 +349,7 @@ int h2_make_htx_request(struct http_hdr *list, struct htx > *htx, unsigned int *ms > phdr = h2_str_to_phdr(list[idx].n); > > for (i = !!phdr; i < list[idx].n.len; i++) > - if ((uint8_t)(list[idx].n.ptr[i] - 'A') < 'Z' - > 'A' || !HTTP_IS_TOKEN(list[idx].n.ptr[i])) > + if ((uint8_t)(list[idx].n.ptr[i] - 'A') <= 'Z' > - 'A' || !HTTP_IS_TOKEN(list[idx].n.ptr[i])) > goto fail; > } > > @@ -665,7 +665,7 @@ int h2_make_htx_response(struct http_hdr *list, struct > htx *htx, unsigned int *m > phdr = h2_str_to_phdr(list[idx].n); > > for (i = !!phdr; i < list[idx].n.len; i++) > - if ((uint8_t)(list[idx].n.ptr[i] - 'A') < 'Z' - > 'A' || !HTTP_IS_TOKEN(list[idx].n.ptr[i])) > + if ((uint8_t)(list[idx].n.ptr[i] - 'A') <= 'Z' > - 'A' || !HTTP_IS_TOKEN(list[idx].n.ptr[i])) > goto fail; > } > > @@ -828,7 +828,7 @@ int h2_make_htx_trailers(struct http_hdr *list, struct > htx *htx) > * also catches pseudo-headers which are forbidden in trailers. > */ > for (i = 0; i < list[idx].n.len; i++) > - if ((uint8_t)(list[idx].n.ptr[i] - 'A') < 'Z' - 'A' || > !HTTP_IS_TOKEN(list[idx].n.ptr[i])) > + if ((uint8_t)(list[idx].n.ptr[i] - 'A') <= 'Z' - 'A' || > !HTTP_IS_TOKEN(list[idx].n.ptr[i])) > goto fail; > > /* these ones are forbidden in trailers (RFC7540#8.1.2.2) */ > diff --git a/src/h3.c b/src/h3.c > index f071748ee9a83..fdad3b06855ff 100644 > --- a/src/h3.c > +++ b/src/h3.c > @@ -546,7 +546,7 @@ static int _h3_handle_hdr(struct qcs *qcs, const struct > http_hdr *hdr) > > for (i = 0; i < istlen(name); ++i) { > const char c = istptr(name)[i]; > - if ((uint8_t)(c - 'A') < 'Z' - 'A' || !HTTP_IS_TOKEN(c)) { > + if ((uint8_t)(c - 'A') <= 'Z' - 'A' || !HTTP_IS_TOKEN(c)) { > TRACE_ERROR("invalid characters in field name", > H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs); > goto err; > } > @@ -1425,7 +1425,7 @@ static ssize_t h3_trailers_to_htx(struct qcs *qcs, > const struct buffer *buf, > > for (i = 0; i < list[hdr_idx].n.len; ++i) { > const char c = list[hdr_idx].n.ptr[i]; > - if ((uint8_t)(c - 'A') < 'Z' - 'A' || > !HTTP_IS_TOKEN(c)) { > + if ((uint8_t)(c - 'A') <= 'Z' - 'A' || > !HTTP_IS_TOKEN(c)) { > TRACE_ERROR("invalid characters in field name", > H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs); > h3s->err = H3_ERR_MESSAGE_ERROR; > qcc_report_glitch(h3c->qcc, 1); Oh, excellent catch, thank you! I'm going to complete the commit message a little bit more and add backport instructions for older branches. Thanks! Willy
