From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Mon, 14 Feb 2022 13:38:55 +0000 (+0100)
Subject: BUG/MINOR: h3: fix the header length for QPACK decoding
X-Git-Tag: v2.6-dev2~150
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4ac6d3733307965201db7ebbd886ab3492239e88;p=thirdparty%2Fhaproxy.git

BUG/MINOR: h3: fix the header length for QPACK decoding

Pass the H3 frame length to QPACK decoding instead of the length of the
whole buffer.

Without this fix, if there is multiple H3 frames starting with a
HEADERS, QPACK decoding will be erroneously applied over all of them,
most probably leading to a decoding error.
---

diff --git a/src/h3.c b/src/h3.c
index 2e4a64c858..e68665bb33 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -134,14 +134,13 @@ static int h3_decode_qcs(struct qcs *qcs, int fin, void *ctx)
 		case H3_FT_HEADERS:
 		{
 			const unsigned char *buf = (const unsigned char *)b_head(rxbuf);
-			size_t len = b_data(rxbuf);
 			struct buffer htx_buf = BUF_NULL;
 			struct buffer *tmp = get_trash_chunk();
 			struct ist meth = IST_NULL, path = IST_NULL;
 			//struct ist scheme = IST_NULL, authority = IST_NULL;
 			struct ist authority = IST_NULL;
 
-			if (qpack_decode_fs(buf, len, tmp, list) < 0) {
+			if (qpack_decode_fs(buf, flen, tmp, list) < 0) {
 				h3->err = QPACK_DECOMPRESSION_FAILED;
 				return -1;
 			}