mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-04 20:46:11 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: h2/h3: Only test number of trailers inserted in HTX message

Browse Source 
When H2 or H3 trailers are inserted in an HTX message, we must take care to
not exceed the maximum number of trailers allowed in a message (same than
the maximum number of headers, i.e tune.http.maxhdr). However, all HTX
blocks in the HTX message were considered. Only TRAILERS HTX blocks must be
considered.

To fix the issue, in h2_make_htx_trailers(), we rely on the "idx" variable
at the end of the for loop. In h3_trailers_to_htx(), we rely on the
"hdr_idx" variable.

This patch must be backported to all stables versions for the H2 part and as
far as 2.8 for the H3 one.

pouet
This commit is contained in:
Christopher Faulet 2026-03-12 11:21:34 +01:00
parent 9c0aeb3af4
commit 3250ec6e9c
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/h2.c
View File

@ -861,8 +861,8 @@ int h2_make_htx_trailers(struct http_hdr *list, struct htx *htx)
goto fail;
}
/* Check the number of blocks against "tune.http.maxhdr" value before adding EOT block */
if (htx_nbblks(htx) > global.tune.max_http_hdr)
/* Check the number of trailers against "tune.http.maxhdr" value before adding EOT block */
if (idx > global.tune.max_http_hdr)
goto fail;
if (!htx_add_endof(htx, HTX_BLK_EOT))

2
src/h3.c
View File

@ -1505,7 +1505,7 @@ static ssize_t h3_trailers_to_htx(struct qcs *qcs, const struct buffer *buf,
}
/* Check the number of blocks against "tune.http.maxhdr" value before adding EOT block */
if (htx_nbblks(htx) > global.tune.max_http_hdr) {
if (hdr_idx > global.tune.max_http_hdr) {
len = -1;
goto out;
}