Release 1.19.4

- [BUGFIX] Check buffer bounds when looking up version in 0-RTT blob.
- [BUGFIX] http_client: don't fetch 0-rtt info if handshake failed.
- Log number of pacer calls at DEBUG, rather than NOTICE, level.

src/liblsquic/lsquic_full_conn.c

@@ -16,6 +16,8 @@
 #endif
 #include <sys/queue.h>
 
+#include <openssl/ssl.h>
+
 #include "lsquic_types.h"
 #include "lsquic.h"
 #include "lsquic_alarmset.h"
@@ -51,6 +53,7 @@
 #include "lsquic_version.h"
 #include "lsquic_hash.h"
 #include "lsquic_headers.h"
+#include "lsquic_handshake.h"
 
 #include "lsquic_conn.h"
 #include "lsquic_conn_public.h"
@@ -650,8 +653,7 @@ full_conn_client_new (struct lsquic_engine_public *enpub,
     version = highest_bit_set(enpub->enp_settings.es_versions);
     if (zero_rtt)
     {
-        zero_rtt_version = lsquic_tag2ver(
-                ((struct lsquic_zero_rtt_storage *)zero_rtt)->quic_version_tag);
+        zero_rtt_version = lsquic_zero_rtt_version(zero_rtt, zero_rtt_len);
         if (zero_rtt_version < N_LSQVER &&
             ((1 << zero_rtt_version) & enpub->enp_settings.es_versions))
             version = zero_rtt_version;

src/liblsquic/lsquic_handshake.c

@@ -1971,3 +1971,18 @@ const char *const lsquic_enclev2str[] =
     [ENC_LEV_INIT]  = "initial",
     [ENC_LEV_FORW]  = "forw-secure",
 };
+
+
+enum lsquic_version
+lsquic_zero_rtt_version (const unsigned char *buf, size_t bufsz)
+{
+    lsquic_ver_tag_t tag;
+
+    if (bufsz >= sizeof(tag))
+    {
+        memcpy(&tag, buf, sizeof(tag));
+        return lsquic_tag2ver(tag);
+    }
+    else
+        return -1;
+}

src/liblsquic/lsquic_handshake.h

@@ -202,4 +202,7 @@ struct enc_session_funcs lsquic_enc_session_gquic_1;
 #define select_esf_by_ver(ver) \
     (ver ? &lsquic_enc_session_gquic_1 : &lsquic_enc_session_gquic_1)
 
+enum lsquic_version
+lsquic_zero_rtt_version (const unsigned char *, size_t);
+
 #endif

src/liblsquic/lsquic_pacer.c

@@ -37,7 +37,7 @@ void
 pacer_cleanup (struct pacer *pacer)
 {
 #ifndef NDEBUG
-    LSQ_NOTICE("scheduled calls: %u", pacer->pa_stats.n_scheduled);
+    LSQ_DEBUG("scheduled calls: %u", pacer->pa_stats.n_scheduled);
 #endif
 }