You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by bc...@apache.org on 2015/11/20 01:37:31 UTC
trafficserver git commit: TS-3945: ASAN error in HTTP/2 when trying
to decode 0 length buffer
Repository: trafficserver
Updated Branches:
refs/heads/6.0.x 6637dbac8 -> 1be3e716a
TS-3945: ASAN error in HTTP/2 when trying to decode 0 length buffer
(cherry picked from commit f9a6930fca6ea458615fa7fef6b7e67c472701ed)
Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo
Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/1be3e716
Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/1be3e716
Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/1be3e716
Branch: refs/heads/6.0.x
Commit: 1be3e716a9350a0d5f95e9fc653f49d9da481f80
Parents: 6637dba
Author: Bryan Call <bc...@apache.org>
Authored: Fri Sep 25 11:30:25 2015 -0700
Committer: Bryan Call <bc...@apache.org>
Committed: Thu Nov 19 16:37:18 2015 -0800
----------------------------------------------------------------------
proxy/http2/HPACK.cc | 8 ++++++++
1 file changed, 8 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/trafficserver/blob/1be3e716/proxy/http2/HPACK.cc
----------------------------------------------------------------------
diff --git a/proxy/http2/HPACK.cc b/proxy/http2/HPACK.cc
index 4c6a702..cdf5640 100644
--- a/proxy/http2/HPACK.cc
+++ b/proxy/http2/HPACK.cc
@@ -501,6 +501,10 @@ encode_literal_header_field(uint8_t *buf_start, const uint8_t *buf_end, const MI
int64_t
decode_integer(uint32_t &dst, const uint8_t *buf_start, const uint8_t *buf_end, uint8_t n)
{
+ if (buf_start >= buf_end) {
+ return HPACK_ERROR_COMPRESSION_ERROR;
+ }
+
const uint8_t *p = buf_start;
dst = (*p & ((1 << n) - 1));
@@ -529,6 +533,10 @@ decode_integer(uint32_t &dst, const uint8_t *buf_start, const uint8_t *buf_end,
int64_t
decode_string(Arena &arena, char **str, uint32_t &str_length, const uint8_t *buf_start, const uint8_t *buf_end)
{
+ if (buf_start >= buf_end) {
+ return HPACK_ERROR_COMPRESSION_ERROR;
+ }
+
const uint8_t *p = buf_start;
bool isHuffman = *p & 0x80;
uint32_t encoded_string_len = 0;