You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2025/08/04 10:32:29 UTC
(tomcat) 01/02: BZ 69762 - enhance
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 60e5784b012e7ac769dca12b7638f19d12926b2c
Author: Chenjp <ch...@msn.com>
AuthorDate: Sat Aug 2 18:44:02 2025 +0800
BZ 69762 - enhance
consider the possibility of integer overflow before result add.
---
java/org/apache/coyote/http2/Hpack.java | 2 +-
test/org/apache/coyote/http2/TestHpack.java | 13 +++++++++++++
2 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/java/org/apache/coyote/http2/Hpack.java b/java/org/apache/coyote/http2/Hpack.java
index 08d5d2555e..4820c68cda 100644
--- a/java/org/apache/coyote/http2/Hpack.java
+++ b/java/org/apache/coyote/http2/Hpack.java
@@ -179,7 +179,7 @@ final class Hpack {
return -1;
}
b = source.get();
- result = result + (b & 127) * (PREFIX_TABLE[m] + 1);
+ result = result + (b & 127) * (PREFIX_TABLE[m] + 1L);
if (result > Integer.MAX_VALUE) {
throw new HpackException(sm.getString("hpack.integerEncodedTooBig"));
}
diff --git a/test/org/apache/coyote/http2/TestHpack.java b/test/org/apache/coyote/http2/TestHpack.java
index 9d39d4acf2..a96453171c 100644
--- a/test/org/apache/coyote/http2/TestHpack.java
+++ b/test/org/apache/coyote/http2/TestHpack.java
@@ -178,6 +178,19 @@ public class TestHpack {
Hpack.decodeInteger(bb, 1);
}
+ @Test(expected = HpackException.class)
+ public void testDecodeIntegerOverflow() throws HpackException {
+ ByteBuffer bb = ByteBuffer.allocate(9);
+ bb.put((byte) 255);
+ bb.put((byte) 254);
+ bb.put((byte) 255);
+ bb.put((byte) 255);
+ bb.put((byte) 255);
+ bb.put((byte) 15);
+ bb.position(0);
+
+ Hpack.decodeInteger(bb, 1);
+ }
@Test(expected = HpackException.class)
public void testDecodeIntegerZeroValues() throws HpackException {
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org