BUG/MINOR: h3: prevent hypothetical demux failure on int overflow
h3s stores the current demux frame type and length as a state info. It
should be big enough to store a QUIC variable-length integer which is
the maximum H3 frame type and size.
Without this patch, there is a risk of integer overflow if H3 frame size
is bigger than INT_MAX. This can typically causes demux state mismatch
and demux frame error. However, no occurence has been found yet of this
bug with the current implementation.
This should be backported up to 2.6.
diff --git a/src/h3.c b/src/h3.c
index a214a22..1572ac1 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -149,8 +149,8 @@
enum h3s_t type;
enum h3s_st_req st_req; /* only used for request streams */
- int demux_frame_len;
- int demux_frame_type;
+ uint64_t demux_frame_len;
+ uint64_t demux_frame_type;
unsigned long long body_len; /* known request body length from content-length header if present */
unsigned long long data_len; /* total length of all parsed DATA */
@@ -1838,7 +1838,7 @@
h3_inc_err_cnt(h3c->prx_counters, err_code);
}
-static inline const char *h3_ft_str(int type)
+static inline const char *h3_ft_str(uint64_t type)
{
switch (type) {
case H3_FT_DATA: return "DATA";
@@ -1875,8 +1875,8 @@
chunk_appendf(&trace_buf, " qcs=%p(%llu)", qcs, (ull)qcs->id);
if (h3s && h3s->demux_frame_type != H3_FT_UNINIT) {
- chunk_appendf(&trace_buf, " h3s.dem=%s/%d",
- h3_ft_str(h3s->demux_frame_type), h3s->demux_frame_len);
+ chunk_appendf(&trace_buf, " h3s.dem=%s/%llu",
+ h3_ft_str(h3s->demux_frame_type), (ull)h3s->demux_frame_len);
}
}
}