Repository: trafficserver Updated Branches: refs/heads/6.0.x 6637dbac8 -> 1be3e716a
TS-3945: ASAN error in HTTP/2 when trying to decode 0 length buffer (cherry picked from commit f9a6930fca6ea458615fa7fef6b7e67c472701ed) Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/1be3e716 Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/1be3e716 Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/1be3e716 Branch: refs/heads/6.0.x Commit: 1be3e716a9350a0d5f95e9fc653f49d9da481f80 Parents: 6637dba Author: Bryan Call <[email protected]> Authored: Fri Sep 25 11:30:25 2015 -0700 Committer: Bryan Call <[email protected]> Committed: Thu Nov 19 16:37:18 2015 -0800 ---------------------------------------------------------------------- proxy/http2/HPACK.cc | 8 ++++++++ 1 file changed, 8 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/trafficserver/blob/1be3e716/proxy/http2/HPACK.cc ---------------------------------------------------------------------- diff --git a/proxy/http2/HPACK.cc b/proxy/http2/HPACK.cc index 4c6a702..cdf5640 100644 --- a/proxy/http2/HPACK.cc +++ b/proxy/http2/HPACK.cc @@ -501,6 +501,10 @@ encode_literal_header_field(uint8_t *buf_start, const uint8_t *buf_end, const MI int64_t decode_integer(uint32_t &dst, const uint8_t *buf_start, const uint8_t *buf_end, uint8_t n) { + if (buf_start >= buf_end) { + return HPACK_ERROR_COMPRESSION_ERROR; + } + const uint8_t *p = buf_start; dst = (*p & ((1 << n) - 1)); @@ -529,6 +533,10 @@ decode_integer(uint32_t &dst, const uint8_t *buf_start, const uint8_t *buf_end, int64_t decode_string(Arena &arena, char **str, uint32_t &str_length, const uint8_t *buf_start, const uint8_t *buf_end) { + if (buf_start >= buf_end) { + return HPACK_ERROR_COMPRESSION_ERROR; + } + const uint8_t *p = buf_start; bool isHuffman = *p & 0x80; uint32_t encoded_string_len = 0;
