RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-01-18 03:30:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MINOR: qpack: abort on dynamic index field line decoding

Browse Source 
This is a complement to partial fix from commit
  debaa04f9e
  BUG/MINOR: qpack: abort on dynamic index field line decoding

The main objective is to fix coverity report about usage of
uninitialized variable when receiving dynamic table references. These
references are invalid as for the moment haproxy advertizes a 0-sized
dynamic table. An ABORT_NOW clause is present to catch this. A following
patch will clean up this in order to properly handle QPACK errors with
CONNECTION_CLOSE.

This should fix github issue #1753.

No need to backport as this was introduced in the current dev branch.
This commit is contained in:
Amaury Denoyelle 2022-06-30 09:31:24 +02:00
parent 2bc47863ec
commit 46e992d795
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/qpack-dec.c
View File

@ -319,11 +319,11 @@ int qpack_decode_fs(const unsigned char *raw, uint64_t len, struct buffer *tmp,
else if (efl_type & QPACK_LFL_WNR_BIT) {
/* Literal field line with name reference */
uint64_t index, length;
unsigned int t, n __maybe_unused, h;
unsigned int static_tbl, n __maybe_unused, h;
qpack_debug_printf(stderr, "Literal field line with name reference:");
n = efl_type & 0x20;
t = efl_type & 0x10;
static_tbl = efl_type & 0x10;
index = qpack_get_varint(&raw, &len, 4);
if (len == (uint64_t)-1) {
qpack_debug_printf(stderr, "##ERR@%d\n", __LINE__);
@ -331,10 +331,20 @@ int qpack_decode_fs(const unsigned char *raw, uint64_t len, struct buffer *tmp,
goto out;
}
if (t)
if (static_tbl) {
name = qpack_sht[index].n;
}
else {
/* TODO not implemented
*
* For the moment, this should never happen as
* currently we do not support dynamic table insertion
* and specify an empty table size.
*/
ABORT_NOW();
}
qpack_debug_printf(stderr, " n=%d t=%d index=%llu", !!n, !!t, (unsigned long long)index);
qpack_debug_printf(stderr, " n=%d t=%d index=%llu", !!n, !!static_tbl, (unsigned long long)index);
h = *raw & 0x80;
length = qpack_get_varint(&raw, &len, 7);
if (len == (uint64_t)-1) {