Willy Tarreau 7f2a44d319 BUG/CRITICAL: hpack: fix improper sign check on the header index value ... Tim Düsterhus found using afl-fuzz that some parts of the HPACK decoder use incorrect bounds checking which do not catch negative values after a type cast. The first culprit is hpack_valid_idx() which takes a signed int and is fed with an unsigned one, but a few others are affected as well due to being designed to work with an uint16_t as in the table header, thus not being able to detect the high offset bits, though they are not exposed if hpack_valid_idx() is fixed. The impact is that the HPACK decoder can be crashed by an out-of-bounds read. The only work-around without this patch is to disable H2 in the configuration. CVE-2018-14645 was assigned to this bug. This patch addresses all of these issues at once. It must be backported to 1.8.		2018-09-20 11:45:56 +02:00
..
common	BUG/CRITICAL: hpack: fix improper sign check on the header index value	2018-09-20 11:45:56 +02:00
import	BUILD: threads/plock: fix a build issue on Clang without optimization	2017-11-20 21:06:35 +01:00
proto	BUILD: connection: silence a couple of null-deref build warnings at -Wextra	2018-09-20 11:42:15 +02:00
types	MEDIUM: h1: better handle transfer-encoding vs content-length	2018-09-14 17:40:35 +02:00