You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@brpc.apache.org by gu...@apache.org on 2026/06/14 04:34:03 UTC
(brpc) branch master updated: Reject zero-length padded DATA frame in H2Context::OnData (#3325)
This is an automated email from the ASF dual-hosted git repository.
chenBright pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/brpc.git
The following commit(s) were added to refs/heads/master by this push:
new b69fabd5 Reject zero-length padded DATA frame in H2Context::OnData (#3325)
b69fabd5 is described below
commit b69fabd5de62c07bdbea45b263d3fbd72b5b675a
Author: sahvx655-wq <sa...@gmail.com>
AuthorDate: Sun Jun 14 10:03:57 2026 +0530
Reject zero-length padded DATA frame in H2Context::OnData (#3325)
---
src/brpc/policy/http2_rpc_protocol.cpp | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/brpc/policy/http2_rpc_protocol.cpp b/src/brpc/policy/http2_rpc_protocol.cpp
index e202d32b..043f53eb 100644
--- a/src/brpc/policy/http2_rpc_protocol.cpp
+++ b/src/brpc/policy/http2_rpc_protocol.cpp
@@ -701,6 +701,10 @@ H2ParseResult H2Context::OnData(
uint32_t frag_size = frame_head.payload_size;
uint8_t pad_length = 0;
if (frame_head.flags & H2_FLAGS_PADDED) {
+ if (frag_size == 0) {
+ LOG(ERROR) << "Invalid payload_size=" << frame_head.payload_size;
+ return MakeH2Error(H2_FRAME_SIZE_ERROR);
+ }
--frag_size;
pad_length = LoadUint8(it);
}
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@brpc.apache.org
For additional commands, e-mail: dev-help@brpc.apache.org