On QMux reception, record header is first decoded to retrieve the record
length. However, an empty record is not rejected. Its header is consumed
but no frame is parsed, so <rx.rlen> remains null while the reception
buffer may still contain data.
If such records fill the reception buffer up to its end, a BUG_ON() is
triggered in qcc_qmux_recv(), as a null record length is not expected
with data stored up to the buffer end. This can be triggered by any
client connected to a QMux listener.
Fix this by closing the connection on empty record reception, similarly
to a record larger than the buffer.
This must be backported up to 3.4.
---
src/qcm_qmux.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/qcm_qmux.c b/src/qcm_qmux.c
index 4491fb726..a1e115942 100644
--- a/src/qcm_qmux.c
+++ b/src/qcm_qmux.c
@@ -172,6 +172,12 @@ int qcc_qmux_recv(struct qcc *qcc)
if (b_data(buf) && !qcc->rx.rlen) {
dec = b_quic_dec_int(&qcc->rx.rlen, buf, NULL);
+ if (dec && !qcc->rx.rlen) {
+ /* TODO report PROTOCOL_VIOLATION on empty
record */
+ qcc->conn->flags |= CO_FL_ERROR;
+ goto out;
+ }
+
if (qcc->rx.rlen > b_size(buf)) {
/* TODO report FRAME_ENCODING_ERROR on
max_record_size violation */
qcc->conn->flags |= CO_FL_ERROR;
--
2.55.0
