Copilot commented on code in PR #13621:
URL: https://github.com/apache/trafficserver/pull/13621#discussion_r4076377686
##########
src/proxy/http3/QPACK.cc:
##########
@@ -1147,20 +1149,30 @@ QPACK::_on_encoder_stream_read_ready(IOBufferReader
&reader)
reader.memcpy(&buf, 1);
if (buf & 0x80) { // Insert With Name Reference
bool is_static;
- uint16_t index;
- const char *name;
- size_t name_len;
- const char *dummy;
- size_t dummy_len;
+ uint64_t index;
+ const char *name = nullptr;
+ size_t name_len = 0;
+ const char *dummy = nullptr;
+ size_t dummy_len = 0;
char *value;
size_t value_len;
if (this->_read_insert_with_name_ref(reader, is_static, index,
this->_arena, &value, value_len) < 0) {
this->_abort_decode();
return EVENT_DONE;
}
- QPACKDebug("Received Insert With Name Ref: is_static=%d, index=%d,
value=%.*s", is_static, index, static_cast<int>(value_len),
- value);
- StaticTable::lookup(index, &name, &name_len, &dummy, &dummy_len);
+ QPACKDebug("Received Insert With Name Ref: is_static=%d, index=%" PRIu64
", value=%.*s", is_static, index,
+ static_cast<int>(value_len), value);
+ XpackLookupResult result;
+ if (is_static) {
+ result = StaticTable::lookup(index, &name, &name_len, &dummy,
&dummy_len);
+ } else {
+ result = this->_dynamic_table.lookup_relative(index, &name, &name_len,
&dummy, &dummy_len);
+ }
+ if (result.match_type != XpackLookupResult::MatchType::EXACT) {
+ this->_arena.str_free(value);
+ this->_abort_decode();
+ return EVENT_DONE;
+ }
this->_dynamic_table.insert_entry(name, name_len, value, value_len);
Review Comment:
On the dynamic-reference path, `name` points into the dynamic table's
storage, but it is passed directly to `insert_entry()`. A valid insertion can
evict/wrap that storage, and `XpackDynamicTableStorage::write()` copies with
`memcpy`; the existing `duplicate_entry()` explicitly copies table-sourced
fields to avoid this overlap. Make an owned copy of the referenced name before
inserting, otherwise a valid dynamic name reference can corrupt the entry or
invoke undefined behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
