BUG/MAJOR: qpack: fix possible read out of bounds in static table
CertiK Skyfall Team reported that passing an index greater than
QPACK_SHT_SIZE in a qpack instruction referencing a literal field
name with name reference or and indexed field line will cause a
read out of bounds that may crash the process, and confirmed that
this fix addresses the issue.
This needs to be backported as far as 2.5.
diff --git a/src/qpack-dec.c b/src/qpack-dec.c
index 2d81156..a6e2923 100644
--- a/src/qpack-dec.c
+++ b/src/qpack-dec.c
@@ -335,7 +335,7 @@
goto out;
}
- if (static_tbl) {
+ if (static_tbl && index < QPACK_SHT_SIZE) {
name = qpack_sht[index].n;
value = qpack_sht[index].v;
}
@@ -370,7 +370,7 @@
goto out;
}
- if (static_tbl) {
+ if (static_tbl && index < QPACK_SHT_SIZE) {
name = qpack_sht[index].n;
}
else {