From e31640368a7280aec82568f89d1f965fcc65f7cd Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Thu, 19 Mar 2026 07:21:47 +0100 Subject: [PATCH] BUG/MINOR: mux-h2: properly ignore R bit in WINDOW_UPDATE increments The window size increments are 31 bits and the topmost bit is reserved and should be ignored, however it was not masked, so a peer sending it set would emit a negative value which could actually reduce the current window instead of increasing it. Note that the window cannot reach zero as there's already a test for this, but transfers could slow down to the same speed as if an initial window of just a few bytes had been advertised. Let's just mask the reserved bit before processing. This should be backported to all stable versions. --- src/mux_h2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mux_h2.c b/src/mux_h2.c index 09606ca39..cc2f2522f 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -3289,7 +3289,7 @@ static int h2c_handle_window_update(struct h2c *h2c, struct h2s *h2s) goto out0; } - inc = h2_get_n32(&h2c->dbuf, 0); + inc = h2_get_n32(&h2c->dbuf, 0) & 0x7FFFFFFF; if (h2c->dsi != 0) { /* stream window update */