]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MINOR: h3: fix the header length for QPACK decoding
authorAmaury Denoyelle <adenoyelle@haproxy.com>
Mon, 14 Feb 2022 13:38:55 +0000 (14:38 +0100)
committerAmaury Denoyelle <adenoyelle@haproxy.com>
Tue, 15 Feb 2022 16:06:22 +0000 (17:06 +0100)
Pass the H3 frame length to QPACK decoding instead of the length of the
whole buffer.

Without this fix, if there is multiple H3 frames starting with a
HEADERS, QPACK decoding will be erroneously applied over all of them,
most probably leading to a decoding error.

src/h3.c

index 2e4a64c8586cafb8422a4243c473dc8ff6e7c624..e68665bb3310153045fb37a947ad0c7c0b10ade9 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -134,14 +134,13 @@ static int h3_decode_qcs(struct qcs *qcs, int fin, void *ctx)
                case H3_FT_HEADERS:
                {
                        const unsigned char *buf = (const unsigned char *)b_head(rxbuf);
-                       size_t len = b_data(rxbuf);
                        struct buffer htx_buf = BUF_NULL;
                        struct buffer *tmp = get_trash_chunk();
                        struct ist meth = IST_NULL, path = IST_NULL;
                        //struct ist scheme = IST_NULL, authority = IST_NULL;
                        struct ist authority = IST_NULL;
 
-                       if (qpack_decode_fs(buf, len, tmp, list) < 0) {
+                       if (qpack_decode_fs(buf, flen, tmp, list) < 0) {
                                h3->err = QPACK_DECOMPRESSION_FAILED;
                                return -1;
                        }