wwbmmm opened a new pull request, #3694:
URL: https://github.com/apache/brpc/pull/3694
### What problem does this PR solve?
Issue Number: resolve N/A
Problem Summary:
The HPACK decoder accepts a zero-length literal header name, which RFC 7541
forbids. `DecodeString()` returns the number of wire bytes consumed (1 for the
`0x00` length octet), not the decoded string length, so the existing
`name_bytes <= 0` check does not reject an empty name. The resulting
`Header{name=""}` is then passed to `IndexTable::AddHeader()`, whose
`CHECK(!h.name.empty())` aborts the process when the header uses incremental
indexing. A malformed HEADERS frame can therefore terminate the server.
### What is changed and the side effects?
Changed:
- `HPacker::DecodeWithKnownPrefix()` now rejects an empty decoded header
name and returns -1, so malformed input is reported as a protocol error and the
connection is closed instead of aborting the process.
- Added `HPackTest.empty_header_name` covering literal header fields with
incremental indexing, without indexing, never indexed, and a Huffman-encoded
empty name.
Side effects:
- Performance effects: none; the new check runs once per literal header
field with a decoded name.
- Breaking backward compatibility: none for valid HPACK input, since an
empty header name is invalid per RFC 7541.
---
### Check List:
- Please make sure your changes are compilable.
- When providing us with a new feature, it is best to add related tests.
- Please follow [Contributor Covenant Code of
Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md).
Tests run:
- `build/test/brpc_hpack_unittest
--gtest_filter=HPackTest.empty_header_name` (passes; fails/aborts without the
fix)
- `build/test/brpc_hpack_unittest` (all other cases pass;
`many_dynamic_table_size_updates` fails before and after this change because
`pthread_attr_setstacksize(64K)` returns EINVAL in this environment)
- `build/test/brpc_http_rpc_protocol_unittest
--gtest_filter='*http2*:*h2_*'` (23/23 pass)
---
🤖 This PR was automatically created by brpc-oncall
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
