Copilot commented on code in PR #13636:
URL: https://github.com/apache/trafficserver/pull/13636#discussion_r3981463853
##########
src/proxy/http3/test/test_QPACK.cc:
##########
@@ -472,3 +472,65 @@ TEST_CASE("Decoding", "[qpack-decode]")
}
}
}
+
+// Decodes one Literal Header Field Without Name Reference. That is the field
+// representation whose name and value are both allocated out of QPACK's
+// per-connection arena and released again once the header is attached, so it
is
+// the path that cares about the order those releases happen in.
+TEST_CASE("Decoding a literal header field without name reference",
"[qpack-literal-decode]")
+{
+ QUICApplicationDriver driver;
+ QPACK *qpack = new QPACK(driver.get_connection(),
UINT32_MAX, 0, 0, MAX_FIELD_SIZE);
+ TestQPACKEventHandler *event_handler = new TestQPACKEventHandler();
+
Review Comment:
This test allocates `QPACK` and `TestQPACKEventHandler` with `new` and never
releases them, which can produce LSAN/ASAN failures even when the test
assertions pass. Prefer stack objects (or other RAII) and keep pointers only as
non-owning aliases.
##########
src/proxy/hdrs/XPACK.cc:
##########
@@ -131,12 +131,14 @@ xpack_decode_string(Arena &arena, char **str, uint64_t
&str_length, const uint8_
if (isHuffman) {
// Allocate temporary area twice the size of before decoded data
uint32_t const str_len = encoded_string_len * 2;
- *str = arena.str_alloc(str_len);
+ char *decoded = arena.str_alloc(str_len);
- len = huffman_decode(*str, str_len, p, encoded_string_len);
+ len = huffman_decode(decoded, str_len, p, encoded_string_len);
if (len < 0) {
Review Comment:
In the Huffman branch, `encoded_string_len` is a `uint64_t` but it is
implicitly narrowed to `uint32_t` (both via `str_len` and the `huffman_decode`
`src_len` parameter). If `max_string_len` is ever configured above
`UINT32_MAX/2`, this can truncate/wrap the lengths, allocate a too-small
buffer, and pass inconsistent sizes into the decoder. Add an explicit bound
check and casts so the function fails safely on oversized inputs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
