Copilot commented on code in PR #13140:
URL: https://github.com/apache/trafficserver/pull/13140#discussion_r3220552196
##########
src/proxy/http3/Http3Frame.cc:
##########
@@ -505,7 +505,7 @@ Http3FrameFactory::create(IOBufferReader &reader)
ts::Http3Config::scoped_config params;
Http3Frame *frame = nullptr;
- uint8_t type_buf[FRAME_TYPE_MAX_BYTES];
+ uint8_t type_buf[FRAME_TYPE_MAX_BYTES]{};
reader.memcpy(type_buf, sizeof(type_buf));
Http3FrameType type = Http3Frame::type(type_buf, sizeof(type_buf));
Review Comment:
Zero-initializing `type_buf` avoids uninitialized reads, but
`Http3Frame::type()` is still given `sizeof(type_buf)` even if
`reader.memcpy()` copies fewer bytes than requested. That can cause truncated
inputs to be interpreted as valid (because the remaining bytes are now zeros)
rather than being rejected as incomplete. Consider using the actual number of
bytes copied / available (e.g., `min(reader.available(), sizeof(type_buf))`)
and passing that length into `Http3Frame::type()`, or returning an 'incomplete
data' result when insufficient bytes are present.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
