BUG/MEDIUM: quic: Missing AEAD TAG check after removing header protection

After removing the packet header protection, we can check the packet is long
enough to contain a 16 bytes length AEAD TAG (at this end of the packet).
This test was missing.

Must be backported to 2.6.

diff --git a/src/xprt_quic.c b/src/xprt_quic.c
index 3705608485cb030bcfdae547ef84a480c751dee2..1589834f197acc853c9928ee8b4e97b6a335bb43 100644 (file)
--- a/src/xprt_quic.c
+++ b/src/xprt_quic.c
@@ -4628,6 +4628,11 @@ static inline int qc_try_rm_hp(struct quic_conn *qc,
 
                /* The AAD includes the packet number field found at <pn>. */
                pkt->aad_len = pn - beg + pkt->pnl;
+               if (pkt->len - pkt->aad_len < QUIC_TLS_TAG_LEN) {
+                       TRACE_PROTO("Too short packet", QUIC_EV_CONN_TRMHP, qc);
+                       goto err;
+               }
+
                qpkt_trace = pkt;
        }
        else {