RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-03-07 03:48:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

MINOR: qpack: Missing check for truncated QPACK fields

Browse Source 
Decrementing <len> variable without checking could make haproxy crash (on abort)
when printing a huge buffer (with negative length).
This commit is contained in:
Frédéric Lécaille 2021-12-15 14:16:16 +01:00 committed by Amaury Denoyelle
parent a5da31d186
commit e629cfd96a
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/qpack-dec.c
View File

@ -228,6 +228,13 @@ int qpack_decode_fs(const unsigned char *raw, size_t len, struct buffer *tmp,
}
qpack_debug_printf(stderr, " h=%d length=%llu", !!h, (unsigned long long)length);
if (len < length) {
qpack_debug_printf(stderr, "##ERR@%d\n", __LINE__);
ret = -QPACK_ERR_TRUNCATED;
goto out;
}
/* XXX Value string XXX */
raw += length;
len -= length;
@ -319,6 +326,12 @@ int qpack_decode_fs(const unsigned char *raw, size_t len, struct buffer *tmp,
list[hdr_idx].v = ist2(raw, length);
}
if (len < length) {
qpack_debug_printf(stderr, "##ERR@%d\n", __LINE__);
ret = -QPACK_ERR_TRUNCATED;
goto out;
}
raw += length;
len -= length;
++hdr_idx;
@ -340,6 +353,13 @@ int qpack_decode_fs(const unsigned char *raw, size_t len, struct buffer *tmp,
qpack_debug_printf(stderr, " n=%d hanme=%d name_len=%llu", !!n, !!hname, (unsigned long long)name_len);
/* Name string */
if (len < name_len) {
qpack_debug_printf(stderr, "##ERR@%d\n", __LINE__);
ret = -QPACK_ERR_TRUNCATED;
goto out;
}
raw += name_len;
len -= name_len;
hvalue = *raw & 0x80;
@ -352,6 +372,12 @@ int qpack_decode_fs(const unsigned char *raw, size_t len, struct buffer *tmp,
qpack_debug_printf(stderr, " hvalue=%d value_len=%llu", !!hvalue, (unsigned long long)value_len);
if (len < value_len) {
qpack_debug_printf(stderr, "##ERR@%d\n", __LINE__);
ret = -QPACK_ERR_TRUNCATED;
goto out;
}
/* XXX Value string XXX */
raw += value_len;
len -= value_len;