Summary
Both QMux implementations omit the STREAM Offset field when encoding and discard it when decoding.
Impact
Under QUIC v1 framing, omitting OFF means offset zero. A second STREAM frame for the same stream is therefore encoded as offset zero rather than immediately following the first. A conforming QMux peer can reject ordinary multi-frame streams, while these implementations silently concatenate malicious gaps or overlaps.
QMux draft-02 keeps the QUIC v1 Offset field and requires PROTOCOL_VIOLATION when a payload does not immediately follow the prior payload: https://datatracker.ietf.org/doc/html/draft-ietf-quic-qmux-02#section-4.1
Suggested fix
Track send offsets and emit OFF, track expected receive offsets, and reject gaps, overlaps, or post-final data. Add cross-implementation tests for sequential writes, gaps, overlaps, and FIN followed by data.
Summary
Both QMux implementations omit the STREAM Offset field when encoding and discard it when decoding.
rs/qmux/src/proto/frame.rsframe.rsjs/qmux/src/frame.tsframe.tsImpact
Under QUIC v1 framing, omitting OFF means offset zero. A second STREAM frame for the same stream is therefore encoded as offset zero rather than immediately following the first. A conforming QMux peer can reject ordinary multi-frame streams, while these implementations silently concatenate malicious gaps or overlaps.
QMux draft-02 keeps the QUIC v1 Offset field and requires
PROTOCOL_VIOLATIONwhen a payload does not immediately follow the prior payload: https://datatracker.ietf.org/doc/html/draft-ietf-quic-qmux-02#section-4.1Suggested fix
Track send offsets and emit OFF, track expected receive offsets, and reject gaps, overlaps, or post-final data. Add cross-implementation tests for sequential writes, gaps, overlaps, and FIN followed by data.