arturobernalg opened a new pull request, #1141: URL: https://github.com/apache/tomcat/pull/1141
RFC 9113, section 6.4 states: > A RST_STREAM frame with a length other than 4 octets MUST be treated as a connection error (Section 5.4.1) of type FRAME_SIZE_ERROR. `FrameType` had `RST` declared with `payloadErrorFatal=false`. When a RST_STREAM frame arrived with a payload size other than 4 bytes on a non-zero stream, `FrameType.check()` fell into the stream-error branch and sent a `RST_STREAM` back to the client. RFC 9113 §6.4 requires a connection error (GOAWAY) instead. The fix sets `payloadErrorFatal=true` for `RST`, so `FrameType.check()` always throws a `ConnectionException` for a malformed RST_STREAM payload, regardless of stream id. For comparison, `PRIORITY` (§6.3) correctly uses `false` because §6.3 says "stream error", and `WINDOW_UPDATE` (§6.9) correctly uses `true` because §6.9 says "connection error". `RST` was the only frame type with the wrong setting. `TestHttp2Section_6_4.testResetFrameWrongLength` is updated to expect `GOAWAY(FRAME_SIZE_ERROR)` instead of the previously incorrect `RST_STREAM(FRAME_SIZE_ERROR)`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
