tree 9057bb8aedc970ff40ce407300a4a82e852a187f
parent 87e95d38a9b9b69462569cc75fd1687b3605be7b
author Frédéric Lécaille <flecaille@haproxy.com> 1659947287 +0200
committer Frédéric Lécaille <flecaille@haproxy.com> 1659949324 +0200

BUG/MEDIUM: quic: Wrong packet length check in qc_do_rm_hp()

When entering this function, we first check the packet length is not too short.
But this was done against the datagram lenght in place of the packet length.
This could lead to the header protection to be removed using data past
the end of the packet (without buffer overflow).

Use the packet length in place of the datagram length which is at <end>
address passed as parameter to this function. As the packet length
is already stored in ->len packet struct member, this <end> parameter is no
more useful.

Must be backported to 2.6.