From e3548e3056be59afb2d763533f693d3bc6046917 Mon Sep 17 00:00:00 2001 From: Roman Arutyunyan Date: Thu, 23 Jul 2026 11:33:13 +0400 Subject: [PATCH] QUIC: apply stream flow control to RESET_STREAM final_size Previously, stream flow control was not applied to the RESET_STREAM final_size, which allowed a client to exceed it. The excess had to be within the connection flow control limits anyway. Reported by Tony Wang. --- src/event/quic/ngx_event_quic_streams.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/event/quic/ngx_event_quic_streams.c b/src/event/quic/ngx_event_quic_streams.c index 18fffeabe..bc2b4014b 100644 --- a/src/event/quic/ngx_event_quic_streams.c +++ b/src/event/quic/ngx_event_quic_streams.c @@ -1481,8 +1481,6 @@ ngx_quic_handle_reset_stream_frame(ngx_connection_t *c, return NGX_OK; } - qs->recv_state = NGX_QUIC_STREAM_RECV_RESET_RECVD; - if (ngx_quic_control_flow(qs, f->final_size) != NGX_OK) { return NGX_ERROR; } @@ -1500,6 +1498,7 @@ ngx_quic_handle_reset_stream_frame(ngx_connection_t *c, } qs->recv_final_size = f->final_size; + qs->recv_state = NGX_QUIC_STREAM_RECV_RESET_RECVD; if (ngx_quic_update_flow(qs, qs->recv_final_size) != NGX_OK) { return NGX_ERROR;