whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HTTP/2 - fix 'GOAWAY' frame size validation 

Found while implementing cleartext http2 (and sending some erroneous
frames) - GOAWAY can have some 'opaque debug information payload' so the
frame's size is at least 8 bytes, but can be more.

Change-Id: I90fb8a3df22768673c4f40ba3bf6a3f5ffe33058
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
bb10
Timur Pocheptsov 2016-07-25 17:41:00 +02:00
parent a594f85d54
commit c0aaef30b1
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/network/access/http2/http2frames.cpp
View File

@ -73,11 +73,15 @@ FrameStatus validate_frame_header(FrameType type, FrameFlags flags, quint32 payl
return FrameStatus::sizeError;
break;
case FrameType::PING:
case FrameType::GOAWAY:
// 6.7 PING, 6.8 GOAWAY
// 6.7 PING
if (payloadSize != 8)
return FrameStatus::sizeError;
break;
case FrameType::GOAWAY:
// 6.8 GOAWAY
if (payloadSize < 8)
return FrameStatus::sizeError;
break;
case FrameType::RST_STREAM:
case FrameType::WINDOW_UPDATE:
// 6.4 RST_STREAM, 6.9 WINDOW_UPDATE