# HG changeset patch
# User Roman Arutyunyan <arut@nginx.com>
# Date 1620210485 -10800
# Node ID 687445803d0f399acca1298d58a9290edae6ae1d
# Parent  0bd1dd39a08b8f50dc744a823b87e405bb156697
HTTP/3: reject empty DATA and HEADERS frames on control stream.

Previously only non-empty frames were rejected.

diff --git a/src/http/v3/ngx_http_v3_parse.c b/src/http/v3/ngx_http_v3_parse.c
--- a/src/http/v3/ngx_http_v3_parse.c
+++ b/src/http/v3/ngx_http_v3_parse.c
@@ -1026,7 +1026,10 @@ ngx_http_v3_parse_control(ngx_connection
         ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0,
                        "http3 parse frame type:%ui", st->type);
 
-        if (ngx_http_v3_is_v2_frame(st->type)) {
+        if (ngx_http_v3_is_v2_frame(st->type)
+            || st->type == NGX_HTTP_V3_FRAME_DATA
+            || st->type == NGX_HTTP_V3_FRAME_HEADERS)
+        {
             return NGX_HTTP_V3_ERR_FRAME_UNEXPECTED;
         }
 
@@ -1069,10 +1072,6 @@ ngx_http_v3_parse_control(ngx_connection
             st->state = sw_max_push_id;
             break;
 
-        case NGX_HTTP_V3_FRAME_DATA:
-        case NGX_HTTP_V3_FRAME_HEADERS:
-            return NGX_HTTP_V3_ERR_FRAME_UNEXPECTED;
-
         default:
             ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0,
                            "http3 parse skip unknown frame");