RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-02-20 12:46:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MINOR: quic: Possible wrapped values used as ACK tree purging limit.

Browse Source 
Add two missing checks not to substract too big values from another too little
one. In this case the resulted wrapped huge values could be passed to the function
which has to remove the last range of a tree of ACK ranges as encoded limit size
not to go below, cancelling the ACK ranges deletion. The consequence could be that
no ACK were sent.

Must be backported to 2.6 and 2.7.
This commit is contained in:
Frédéric Lécaille 2023-04-12 20:49:29 +02:00
parent 45bf1a82f1
commit 9d68c6aaf6
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/quic_conn.c
View File

@ -7294,6 +7294,9 @@ static int quic_ack_frm_reduce_sz(struct quic_conn *qc,
TRACE_ENTER(QUIC_EV_CONN_TXPKT, qc);
ack_delay_sz = quic_int_getsize(ack_frm->tx_ack.ack_delay);
if (limit <= ack_delay_sz - 1)
goto leave;
/* A frame is made of 1 byte for the frame type. */
room = limit - ack_delay_sz - 1;
if (!quic_rm_last_ack_ranges(qc, ack_frm->tx_ack.arngs, room))
@ -7721,6 +7724,9 @@ static int qc_do_build_pkt(unsigned char *pos, const unsigned char *end,
* This will be decided after having computed the ack-eliciting frames
* to be added to this packet.
*/
if (end - pos <= 1 + *pn_len)
goto no_room;
ack_frm_len = quic_ack_frm_reduce_sz(qc, &ack_frm, end - 1 - *pn_len - pos);
if (!ack_frm_len)
goto no_room;