From c9fce97dcb190eac5591ecab683d49ffd30b1c71 Mon Sep 17 00:00:00 2001
From: Stefan Eissing <stefan@eissing.org>
Date: Thu, 25 Sep 2025 10:42:24 +0200
Subject: [PATCH] cf-h2-proxy: break loop on edge case

nghttp2 always consumes the memory, but be safe in case it ever decideds
to not to.

Fixes J2
Reported in Joshua's sarif data
Closes #18715
---
 lib/cf-h2-proxy.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/cf-h2-proxy.c b/lib/cf-h2-proxy.c
index d67bbd55ad..17a15c1d2a 100644
--- a/lib/cf-h2-proxy.c
+++ b/lib/cf-h2-proxy.c
@@ -433,6 +433,11 @@ static int proxy_h2_process_pending_input(struct Curl_cfilter *cf,
       *err = CURLE_RECV_ERROR;
       return -1;
     }
+    else if(!rv) {
+      /* nghttp2 does not want to process more, but has no error. This
+       * probably cannot happen, but be safe. */
+      break;
+    }
     Curl_bufq_skip(&ctx->inbufq, (size_t)rv);
     if(Curl_bufq_is_empty(&ctx->inbufq)) {
       CURL_TRC_CF(data, cf, "[0] all data in connection buffer processed");