RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-04-22 06:55:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MINOR: hpack: return a compression error on invalid table size updates

Browse Source 
RFC7541#6.3 mandates that an error is reported when a dynamic table size
update announces a size larger than the one configured with settings. This
is tested by h2spec using test "hpack/6.3/1".

This must be backported to 1.9 and possibly 1.8 as well.
This commit is contained in:
Willy Tarreau 2019-01-24 10:47:10 +01:00
parent 175cebb38a
commit 1e7d444eec
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/common/hpack-tbl.h
View File

@ -127,6 +127,7 @@ enum {
HPACK_ERR_MISSING_AUTHORITY, /* :authority is missing with CONNECT */ HPACK_ERR_MISSING_AUTHORITY, /* :authority is missing with CONNECT */
HPACK_ERR_SCHEME_NOT_ALLOWED, /* :scheme not allowed with CONNECT */ HPACK_ERR_SCHEME_NOT_ALLOWED, /* :scheme not allowed with CONNECT */
HPACK_ERR_PATH_NOT_ALLOWED, /* :path not allowed with CONNECT */ HPACK_ERR_PATH_NOT_ALLOWED, /* :path not allowed with CONNECT */
HPACK_ERR_INVALID_ARGUMENT, /* an invalid argument was passed */
}; };
/* static header table as in RFC7541 Appendix A. [0] unused. */ /* static header table as in RFC7541 Appendix A. [0] unused. */

6
src/hpack-dec.c
View File

@ -232,6 +232,12 @@ int hpack_decode_frame(struct hpack_dht *dht, const uint8_t *raw, uint32_t len,
goto leave; goto leave;
} }
hpack_debug_printf(" new len=%u\n", idx); hpack_debug_printf(" new len=%u\n", idx);
if (idx > dht->size) {
hpack_debug_printf("##ERR@%d##\n", __LINE__);
ret = -HPACK_ERR_INVALID_ARGUMENT;
goto leave;
}
continue; continue;
} }
else if (!(*raw & (*raw - 0x10))) { else if (!(*raw & (*raw - 0x10))) {