SABITHSAHEB opened a new pull request, #13924: URL: https://github.com/apache/trafficserver/pull/13924
1. QPACK::encode() compresses every field of a response header set into a single 2 KB IOBufferBlock, and _encode_header() ignores the per-field encoders' failures, so a response whose compressed field section is larger than 2 KB goes out over HTTP/3 with the trailing fields silently dropped. A Set-Cookie or security header that lands past that point never reaches the client, and encode() still reports success. 2. Each field encoder stores the instruction's first byte at compressed_header->end() before it checks the space left, so a block that an earlier field filled exactly takes a one byte write past the end of its buffer. Sized the blocks for the fields and chain more as needed (4 bytes per input byte covers the longest Huffman code, plus the varints), made encoder failures propagate out of encode() instead of being swallowed, and added the full-block check before the first byte is written. The new round trip test in test_QPACK.cc encodes a 64 field header set and decodes it with a second QPACK instance; on master only 10 of the fields survive. HTTP/3 is listed in SECURITY.md as publicly reportable, which is why this comes as a regular PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
