SABITHSAHEB opened a new pull request, #13921: URL: https://github.com/apache/trafficserver/pull/13921
1. QPACK::StaticTable::lookup() indexes the fixed 99-entry STATIC_HEADER_FIELDS array with the index a client puts in a QPACK Indexed Header Field (6-bit prefix) or Literal Header Field With Name Reference (4-bit prefix), with no upper bound, so index 99 or higher reads past the table and the out-of-bounds Header name/value pointers and lengths are attached to the decoded request. 2. The encoder-stream Insert With Name Reference path reaches the same lookup and ignored its result, so it consumed whatever the lookup left in the out-params. 3. Added the missing bound in the callee (clear the out-params and return a NONE match when index >= countof(STATIC_HEADER_FIELDS)), and made the encoder-stream caller abort decoding on a non-exact lookup. The two decode-path static lookups already check the returned match type, so the callee bound is enough to turn the read into a clean decode failure. Trigger: a HEADERS block of 00 00 ff 24 (prefix 0/0, then an Indexed Header Field, static table, index 99) drives StaticTable::lookup(99). Under ASan the unpatched decoder faults with a global-buffer-overflow read 0 bytes past STATIC_HEADER_FIELDS. Added a catch2 regression in test_QPACK.cc that feeds that block through QPACK::decode() and asserts failure rather than completion; it faults before the fix and passes after. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
