iv-org-mirror/litespeed-quic
1
0
Fork 0
mirror of https://gitea.invidious.io/iv-org/litespeed-quic.git synced 2024-08-15 00:53:43 +00:00
Code Issues Projects Releases Packages Wiki Activity

HPACK: do not allow header block to end with table size update

Browse source
This commit is contained in:
Dmitri Tikhonov 2018-04-27 14:36:21 -04:00
parent 130d542a00
commit bf6b47adbf
5 changed files with 57 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/liblsquic/lsquic_frame_reader.c
View file

@ -938,19 +938,15 @@ decode_and_pass_payload (struct lsquic_frame_reader *fr)
s = lsquic_hdec_decode(fr->fr_hdec, &comp, end,
hwc.buf, hwc.buf + 16 * 1024,
&hwc.name_len, &hwc.val_len);
if (s > 0)
if (s == 0)
{
err = add_header_to_uh(fr, &hwc);
if (0 != err)
goto stream_error;
}
else if (s < 0)
{
err = FR_ERR_DECOMPRESS;
goto stream_error;
if (err == 0)
continue;
}
else
break;
err = FR_ERR_DECOMPRESS;
goto stream_error;
}
assert(comp == end);

10
src/liblsquic/lsquic_hpack_dec.c
View file

@ -290,7 +290,7 @@ lsquic_hdec_decode (struct lsquic_hdec *dec,
int indexed_type, len;
if ((*src) == src_end)
return 0;
return -1;
while ((*(*src) & 0xe0) == 0x20) //001 xxxxx
{
@ -300,7 +300,7 @@ lsquic_hdec_decode (struct lsquic_hdec *dec,
return -1;
hdec_update_max_capacity(dec, new_capacity);
if (*src == src_end)
return 0;
return -1;
}
/* lsquic_hdec_dec_int() sets `index' and advances `src'. If we do not call
@ -373,7 +373,7 @@ lsquic_hdec_decode (struct lsquic_hdec *dec,
return -1;
*val_len = lsquic_hpack_stx_tab[index - 1].val_len;
memcpy(name + *name_len, lsquic_hpack_stx_tab[index - 1].val, *val_len);
return 1;
return 0;
}
}
else
@ -392,7 +392,7 @@ lsquic_hdec_decode (struct lsquic_hdec *dec,
return -1;
*val_len = entry->dte_val_len;
memcpy(name + *name_len, DTE_VALUE(entry), *val_len);
return 1;
return 0;
}
}
}
@ -421,7 +421,7 @@ lsquic_hdec_decode (struct lsquic_hdec *dec,
return -1; //error
}
return 1;
return 0;
}

15
src/liblsquic/lsquic_hpack_dec.h
View file

@ -22,16 +22,11 @@ lsquic_hdec_init (struct lsquic_hdec *);
void
lsquic_hdec_cleanup (struct lsquic_hdec *);
/** @lsquic_hdecode
* @brief HPACK decode one name/value item
* @param[in,out] dec - A pointer to a valid HPACK API struct
* @param[in,out] src - Address of pointer to source buffer
* @param[in] src_end - A pointer to end of source buffer
* @param[out] dst - A pointer to destination buffer
* @param[out] dst_end - A pointer to end of destination buffer
* @param[out] name_len - The item name's length
* @param[out] value_len - The item value's length
* @return 1: OK, 0: end, -1: FAIL
/*
* Returns 0 on success, a negative value on failure.
*
* If 0 is returned, `src' is advanced. Calling with a zero-length input
* buffer results in an error.
*/
int
lsquic_hdec_decode (struct lsquic_hdec *dec,