From 0ed94032b21c06cb3a11455b02ff72a98d4ff3e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20L=C3=A9caille?= <flecaille@haproxy.com>
Date: Mon, 17 Apr 2023 14:10:14 +0200
Subject: [PATCH] MINOR: quic: Do not allocate too much ack ranges

Limit the maximum number of ack ranges to QUIC_MAX_ACK_RANGES(32).

Must be backported to 2.6 and 2.7.
---
 include/haproxy/quic_conn-t.h |  3 +++
 src/quic_conn.c               | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/include/haproxy/quic_conn-t.h b/include/haproxy/quic_conn-t.h
index 26fd60b8e..113cc61bb 100644
--- a/include/haproxy/quic_conn-t.h
+++ b/include/haproxy/quic_conn-t.h
@@ -321,6 +321,9 @@ struct quic_arng_node {
 	uint64_t last;
 };
 
+/* The maximum number of ack ranges to be built in ACK frames */
+#define QUIC_MAX_ACK_RANGES   32
+
 /* Structure to maintain a set of ACK ranges to be used to build ACK frames. */
 struct quic_arngs {
 	/* ebtree of ACK ranges organized by their first value. */
diff --git a/src/quic_conn.c b/src/quic_conn.c
index 2992ba0a9..86fcc1e0e 100644
--- a/src/quic_conn.c
+++ b/src/quic_conn.c
@@ -4246,6 +4246,16 @@ struct quic_arng_node *quic_insert_new_range(struct quic_conn *qc,
 
 	TRACE_ENTER(QUIC_EV_CONN_RXPKT, qc);
 
+	if (arngs->sz >= QUIC_MAX_ACK_RANGES) {
+		struct eb64_node *last;
+
+		last = eb64_last(&arngs->root);
+		BUG_ON(last == NULL);
+		eb64_delete(last);
+		pool_free(pool_head_quic_arng, last);
+		arngs->sz--;
+	}
+
 	new_ar = pool_alloc(pool_head_quic_arng);
 	if (!new_ar) {
 		TRACE_ERROR("ack range allocation failed", QUIC_EV_CONN_RXPKT, qc);