[a23.5] Fix CVE-2026-33555 in haproxy · Pull Request !125 · src-anolis-os/haproxy

### Description
Backport of upstream fix for **CVE-2026-33555** (HTTP/3 request smuggling, CWE-130) to the a23.5 maintenance branch.

The HTTP/3 parser in `h3_rcv_buf()` took a shortcut for a QUIC STREAM frame with an empty payload and the FIN bit set, calling `qcs_http_handle_standalone_fin()` directly. This bypassed the body-size vs `Content-Length` validation, allowing a truncated body to be forwarded and desynchronizing the backend connection (request smuggling).

### Fix
Upstream commit `05a295441c621089ffa4318daf0dbca2dd756a84` — *BUG/MAJOR: h3: check body size with content-length on empty FIN*.
`h3_check_body_size()` is now called before `qcs_http_handle_standalone_fin()` when `H3_SF_HAVE_CLEN` is set; on mismatch the stream read is aborted and the stream reset with `H3_MESSAGE_ERROR`.

### Changes
- Add `CVE-2026-33555.patch` (`src/h3.c`, +8 lines, unmodified upstream hunk)
- Register as `Patch2` in `haproxy.spec`
- Bump `anolis_release` 1 -> 2, add changelog entry for 3.2.0-2

### Verification
- `rpmbuild -bp` succeeds; both patches apply with `--fuzz=0` (no fuzz, no offset)
- `src/h3.c` compiles cleanly (`USE_QUIC=1`)
- Applies via `git apply -p1`, matching `%autosetup -p1`

### Note
The Anolis build does not set `USE_QUIC=1`, so `src/h3.o` is not currently linked into the shipped binary; the patch corrects the affected source regardless.

Companion PR for a23: https://gitee.com/src-anolis-os/haproxy/pulls/122

src-anolis-os / haproxy .gitee-modal { width: 500px !important; }

搜索帮助

src-anolis-os / haproxy