mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-08 08:07:10 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: h3: fix parsing of unknown frame type with null length

Browse Source 
HTTP/3 implementation must ignore unknown frame type to support protocol
evolution. Clients can deliberately use unknown type to test that the
server is conformant : this principle is called greasing.

Quiche client uses greasing on H3 frame type with a zero length frame.
This reveals a bug in H3 parsing code which causes the transfer to be
interrupted. Fix this by removing the break statement on ret variable.
Now the parsing loop is only interrupted if input buffer is empty or the
demux is blocked.

This should fix http/3 freeze transfers with the quiche client. Thanks
to Lucas Pardue from Cloudflare for his report on the bug. Frédéric
Lecaille quickly found the source of the problem which helps me to write
this patch.
This commit is contained in:
Amaury Denoyelle 2022-05-02 10:35:39 +02:00
parent f1fc0b393b
commit 291ee25696
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/h3.c
View File

@ -315,12 +315,11 @@ static int h3_decode_qcs(struct qcs *qcs, int fin, void *ctx)
ret = MIN(b_data(rxbuf), flen);
}
if (!ret)
break;
b_del(rxbuf, ret);
BUG_ON(h3s->demux_frame_len < ret);
h3s->demux_frame_len -= ret;
if (ret) {
b_del(rxbuf, ret);
BUG_ON(h3s->demux_frame_len < ret);
h3s->demux_frame_len -= ret;
}
}
/* TODO may be useful to wakeup the MUX if blocked due to full buffer.