Patches 1 and 2 were found with UndefinedBehaviorSanitizer and the OSS-Fuzz harnesses, the others by code reading:
1. Status codes above 511 were undefined behaviour in C++. 2. Three parameters that accept size zero were declared as VLAs. 3. HTTP/2 requests with empty or undefined pseudo-headers were served. 4. A first SETTINGS frame with one setting was ignored. 5. WINDOW_UPDATE added the stream id instead of the increment. 6. Dead code in process_inc_frame(). 7. The client's SETTINGS acknowledgement stalled the connection. 8. The field iterator reported the value length as the name length. 9. The TLS session query returned an error on success. Patches 3, 5 and 7-9 add or extend tests that fail without their fix. The first window case of patch 5 also fails without patch 4. make check shows no new failure at any patch. Question: req_headers_preprocess() accepts an HTTP/2 request with no :authority and an empty host header. Is that intended? Sami Jawhar (9): microhttpd2.h: added sentinel to enum MHD_HTTP_StatusCode Removed array size from parameters that can be zero-sized HTTP/2: added checks for invalid pseudo-headers HTTP/2: fixed ignoring of a SETTINGS frame with one setting HTTP/2: fixed stream window increment HTTP/2: removed unreachable return and unused enum HTTP/2: added processing of the settings acknowledgement HTTP/2: fixed name length of request fields in iterator Fixed status code of the TLS session connection info doc/manual/responses.inc | 4 +- src/include/microhttpd2.h | 19 +- src/include/microhttpd2_main.h.in | 16 +- src/include/microhttpd2_preamble.h.in | 3 +- src/mhd2/conn_get_info.c | 2 +- src/mhd2/h2/h2_conn_streams.c | 4 +- src/mhd2/h2/h2_conn_streams.h | 2 + src/mhd2/h2/h2_proc_in.c | 13 +- src/mhd2/h2/h2_proc_settings.c | 11 +- src/mhd2/h2/h2_proc_settings.h | 8 + src/mhd2/h2/h2_req_fields.c | 6 + src/mhd2/h2/h2_req_get_items.c | 2 +- src/mhd2/response_from.c | 11 +- src/mhd2/stream_process_request.c | 2 +- src/mhd2/stream_process_request.h | 2 +- src/tests/client_server/libtest.h | 30 +- .../libtest_convenience_server_reply.c | 104 ++ src/tests/client_server/test_tls.c | 9 + src/tests/raw/Makefile.am | 5 + src/tests/raw/test_h2_raw.c | 1082 +++++++++++++++++ 20 files changed, 1304 insertions(+), 31 deletions(-) create mode 100644 src/tests/raw/test_h2_raw.c base-commit: 24a2913c4e1cb31a5cff52047beae146959d50b0 -- 2.43.0
