tree bda5f723fb47d80e38f2a8e90eabc86d992baf5c
parent dc7e6a85f14cf68ee01e54759015fe330e8e664d
author Amaury Denoyelle <adenoyelle@haproxy.com> 1722529208 +0200
committer Willy Tarreau <w@1wt.eu> 1725550327 +0200
encoding latin1

BUG/MINOR: h3: properly reject too long header responses

When encoding HTX to HTTP/3 headers on the response path, a bunch of
ABORT_NOW() where used when buffer room was not enough. In most cases
this is safe as output buffer has just been allocated and so is empty at
the start of the function. However, with a header list longer than a
whole buffer, this would cause an unexpected crash.

Fix this by removing ABORT_NOW() statement with proper error return
path. For the moment, this would cause the whole connection to be close
rather than the stream only. This may be further improved in the future.

Also remove ABORT_NOW() when encoding frame length at the end of headers
or trailers encoding. Buffer room is sufficient as it was already
checked prior in the same function.

This should be backported up to 2.6. Special care should be handled
however as this code path has changed frequently :
* for 2.9 and older, the extra following statement must be inserted
  prior each newly added goto statement :
  h3c->err = H3_INTERNAL_ERROR;
* for 2.6, trailers support is not implemented. As such, related chunks
  should just be ignored when backporting.

(cherry picked from commit 48514c118ce881e2ae20aeb1edda929663a8397d)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit b8523ffaf8c34a29e38120051355115564667c46)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 14be6613bcb1c92997d8f4e4387df8e3129edbf5)
Signed-off-by: Willy Tarreau <w@1wt.eu>