BUG/MINOR: quic: Unchecked buffer length when building the token
As server, an Initial does not contain a token but only the token length field
with zero as value. The remaining room was not checked before writting this field.
Must be backported to 2.6 and 2.7.
diff --git a/src/quic_conn.c b/src/quic_conn.c
index 86fcc1e..10a2948 100644
--- a/src/quic_conn.c
+++ b/src/quic_conn.c
@@ -7771,8 +7771,13 @@
goto no_room;
/* Encode the token length (0) for an Initial packet. */
- if (pkt->type == QUIC_PACKET_TYPE_INITIAL)
+ if (pkt->type == QUIC_PACKET_TYPE_INITIAL) {
+ if (end <= pos)
+ goto no_room;
+
*pos++ = 0;
+ }
+
head_len = pos - beg;
/* Build an ACK frame if required. */
ack_frm_len = 0;