dxbjavid opened a new pull request, #13394: URL: https://github.com/apache/trafficserver/pull/13394
xpack_decode_integer accumulates the continuation bytes of an HPACK/QPACK integer by shifting each 7-bit group left by an amount that grows seven per byte and is never bounded, so a header field carrying a long run of continuation bytes drives that shift width past 64. Once it does the guard on the preceding line that is meant to reject over-large encodings shifts by the same out-of-range amount and quietly stops rejecting anything, which is undefined behaviour on the wire-facing path shared by both the HTTP/2 and HTTP/3 header decoders. The loop now stops as soon as the shift width reaches the width of the accumulator so an over-long encoding is treated as a compression error, and I have added a decoding case to test_XPACK.cc that fails without the change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
