From b21342258a0674686627e98aa2c76e53b2da723b Mon Sep 17 00:00:00 2001 From: Tatsuhiro Tsujikawa Date: Wed, 18 Feb 2026 18:04:30 +0900 Subject: [PATCH 2/2] Fix missing iframe->state validations to avoid assertion failure (cherry picked from commit 5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1) --- lib/nghttp2_session.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c index bcea5473..0fbcc930 100644 --- a/lib/nghttp2_session.c +++ b/lib/nghttp2_session.c @@ -5573,6 +5573,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, return rv; } + if (iframe->state == NGHTTP2_IB_IGN_ALL) { + return (nghttp2_ssize)inlen; + } + on_begin_frame_called = 1; rv = session_process_headers_frame(session); @@ -6041,6 +6045,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, if (nghttp2_is_fatal(rv)) { return rv; } + + if (iframe->state == NGHTTP2_IB_IGN_ALL) { + return (nghttp2_ssize)inlen; + } } } @@ -6293,6 +6301,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, return rv; } + if (iframe->state == NGHTTP2_IB_IGN_ALL) { + return (nghttp2_ssize)inlen; + } + session_inbound_frame_reset(session); break; @@ -6599,6 +6611,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, if (nghttp2_is_fatal(rv)) { return rv; } + + if (iframe->state == NGHTTP2_IB_IGN_ALL) { + return (nghttp2_ssize)inlen; + } } else { iframe->state = NGHTTP2_IB_IGN_HEADER_BLOCK; } @@ -6775,6 +6791,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, return NGHTTP2_ERR_CALLBACK_FAILURE; } + if (iframe->state == NGHTTP2_IB_IGN_ALL) { + return (nghttp2_ssize)inlen; + } + if (rv == NGHTTP2_ERR_PAUSE) { return (nghttp2_ssize)(in - first); } @@ -6861,6 +6881,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, return rv; } + if (iframe->state == NGHTTP2_IB_IGN_ALL) { + return (nghttp2_ssize)inlen; + } + if (rv != 0) { busy = 1; @@ -6879,6 +6903,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, return rv; } + if (iframe->state == NGHTTP2_IB_IGN_ALL) { + return (nghttp2_ssize)inlen; + } + session_inbound_frame_reset(session); break; @@ -6907,6 +6935,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, return rv; } + if (iframe->state == NGHTTP2_IB_IGN_ALL) { + return (nghttp2_ssize)inlen; + } + session_inbound_frame_reset(session); break; -- 2.53.0