From 0777b7dded26b3584a5b05fa93867224371750c5 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Wed, 20 Nov 2024 16:27:34 +0100 Subject: [PATCH] BUG/MEDIUM: mux-h2: Check the number of headers in HEADERS frame after decoding There is no explicit test on the number of headers when a HEADERS frame is received. It is implicitely limited by the size of the header list. But it is twice the configured limit to be sure to decode the frame. So now, a check is performed after the HTX message was created. This way, we are sure to not exceed the configured limit after the decoding stage. If there are too many headers, a parsing error is reported. Note the same is performed on the trailers. This patch should patially address the issue #2685. It should be backported to all stable versions. (cherry picked from commit 63d2760dfa679bea4b7a61a1a8702af23cf26e75) Signed-off-by: Christopher Faulet --- src/h2.c | 12 ++++++++++++ src/mux_h2.c | 1 + 2 files changed, 13 insertions(+) diff --git a/src/h2.c b/src/h2.c index a9e8b65..721fb47 100644 --- a/src/h2.c +++ b/src/h2.c @@ -494,6 +494,10 @@ int h2_make_htx_request(struct http_hdr *list, struct htx *htx, unsigned int *ms goto fail; } + /* Check the number of blocks agains "tune.http.maxhdr" value before adding EOH block */ + if (htx_nbblks(htx) > global.tune.max_http_hdr) + goto fail; + /* now send the end of headers marker */ if (!htx_add_endof(htx, HTX_BLK_EOH)) goto fail; @@ -745,6 +749,10 @@ int h2_make_htx_response(struct http_hdr *list, struct htx *htx, unsigned int *m */ } + /* Check the number of blocks agains "tune.http.maxhdr" value before adding EOH block */ + if (htx_nbblks(htx) > global.tune.max_http_hdr) + goto fail; + /* now send the end of headers marker */ if (!htx_add_endof(htx, HTX_BLK_EOH)) goto fail; @@ -812,6 +820,10 @@ int h2_make_htx_trailers(struct http_hdr *list, struct htx *htx) goto fail; } + /* Check the number of blocks agains "tune.http.maxhdr" value before adding EOT block */ + if (htx_nbblks(htx) > global.tune.max_http_hdr) + goto fail; + if (!htx_add_endof(htx, HTX_BLK_EOT)) goto fail; diff --git a/src/mux_h2.c b/src/mux_h2.c index 3c2f65e..1e567a7 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -5498,6 +5498,7 @@ next_frame: /* Trailers terminate a DATA sequence */ if (h2_make_htx_trailers(list, htx) <= 0) { TRACE_STATE("failed to append HTX trailers into rxbuf", H2_EV_RX_FRAME|H2_EV_RX_HDR|H2_EV_H2S_ERR, h2c->conn); + htx->flags |= HTX_FL_PARSING_ERROR; goto fail; } *flags |= H2_SF_ES_RCVD; -- 1.7.10.4