tree 70783b2b034d6da4f559e79d577f602a59c85d0d
parent 8868ac34aeb0bd1cf902820eff3ea49dcafea1ca
author Willy Tarreau <w@1wt.eu> 1585464811 +0200
committer Willy Tarreau <w@1wt.eu> 1585810823 +0200
encoding latin1

BUG/CRITICAL: hpack: never index a header into the headroom after wrapping

The HPACK header table is implemented as a wrapping list inside a contigous
area. Headers names and values are stored from right to left while indexes
are stored from left to right. When there's no more room to store a new one,
we wrap to the right again, or possibly defragment it if needed. The condition
do use the right part (called tailroom) or the left part (called headroom)
depends on the location of the last inserted header. After wrapping happens,
the code forces to stick to tailroom by pretending there's no more headroom,
so that the size fit test always fails. The problem is that nothing prevents
from storing a header with an empty name and empty value, resulting in a
total size of zero bytes, which satisfies the condition to use the headroom.
Doing this in a wrapped buffer results in changing the "front" header index
and causing miscalculations on the available size and the addresses of the
next headers. This may even allow to overwrite some parts of the index,
opening the possibility to perform arbitrary writes into a 32-bit relative
address space.

This patch fixes the issue by making sure the headroom is considered only
when the buffer does not wrap, instead of relying on the zero size. This
must be backported to all versions supporting H2, which is as far as 1.8.

Many thanks to Felix Wilhelm of Google Project Zero for responsibly
reporting this problem with a reproducer and a detailed analysis.
CVE-2020-11100 was assigned to this issue.

(cherry picked from commit 5dfc5d5cd0d2128d77253ead3acf03a421ab5b88)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit f17f86304f187b0f10ca6a8d46346afd9851a543)
Signed-off-by: Willy Tarreau <w@1wt.eu>