From: Hugo Landau <hlandau@openssl.org>
Date: Tue, 6 Jun 2023 15:25:11 +0000 (+0100)
Subject: RFC 9000 s. 19.8: Enforce maximum stream size
X-Git-Tag: openssl-3.2.0-alpha1~441
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=283938fca59a7930a28e748e8ab7c2d15281c681;p=thirdparty%2Fopenssl.git

RFC 9000 s. 19.8: Enforce maximum stream size

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21135)
---

diff --git a/ssl/quic/quic_rx_depack.c b/ssl/quic/quic_rx_depack.c
index 6e2067f451c..c75363d0387 100644
--- a/ssl/quic/quic_rx_depack.c
+++ b/ssl/quic/quic_rx_depack.c
@@ -519,6 +519,21 @@ static int depack_do_frame_stream(PACKET *pkt, QUIC_CHANNEL *ch,
         return 0;
     }
 
+    /*
+     * RFC 9000 s. 19.8: "The largest offset delivered on a stream -- the sum of
+     * the offset and data length -- cannot exceed 2**62 - 1, as it is not
+     * possible to provide flow control credit for that data. Receipt of a frame
+     * that exceeds this limit MUST be treated as a connection error of type
+     * FRAME_ENCODING_ERROR or FLOW_CONTROL_ERROR."
+     */
+    if (frame_data.offset + frame_data.len > (((uint64_t)1) << 62) - 1) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               frame_type,
+                                               "oversize stream");
+        return 0;
+    }
+
     switch (stream->recv_state) {
     case QUIC_RSTREAM_STATE_RECV:
     case QUIC_RSTREAM_STATE_SIZE_KNOWN: