tree 73d60658e3fa96edf3c4d7a5329f2e8c9e860b81
parent 9eb2a4addfb25c4a3c99cd6c78101b9ec7469393
author Willy Tarreau <w@1wt.eu> 1523953707 +0200
committer Willy Tarreau <w@1wt.eu> 1524126930 +0200
encoding latin1

BUG/CRITICAL: h2: fix incorrect frame length check

The incoming H2 frame length was checked against the max_frame_size
setting instead of being checked against the bufsize. The max_frame_size
only applies to outgoing traffic and not to incoming one, so if a large
enough frame size is advertised in the SETTINGS frame, a wrapped frame
will be defragmented into a temporary allocated buffer where the second
fragment my overflow the heap by up to 16 kB.

It is very unlikely that this can be exploited for code execution given
that buffers are very short lived and their address not realistically
predictable in production, but the likeliness of an immediate crash is
absolutely certain.

This fix must be backported to 1.8.

Many thanks to Jordan Zebor from F5 Networks for reporting this issue
in a responsible way.