diff options
| author | Vladimir Homutov <vl@nginx.com> | 2021-04-19 11:36:41 +0300 |
|---|---|---|
| committer | Vladimir Homutov <vl@nginx.com> | 2021-04-19 11:36:41 +0300 |
| commit | db4c8fe45f8c609a85b52547891d6ba992c30b4e (patch) | |
| tree | fa40e58e63b9ba186cfb4afe0a53262563802f71 /src | |
| parent | 17eebfea99bb554741a5732ed3a4472399591c5a (diff) | |
| download | nginx-db4c8fe45f8c609a85b52547891d6ba992c30b4e.tar.gz nginx-db4c8fe45f8c609a85b52547891d6ba992c30b4e.zip | |
QUIC: fixed parsing of unknown frame types.
The ngx_quic_frame_allowed() function only expects known frame types.
Diffstat (limited to 'src')
| -rw-r--r-- | src/event/quic/ngx_event_quic_transport.c | 7 | ||||
| -rw-r--r-- | src/event/quic/ngx_event_quic_transport.h | 2 |
2 files changed, 9 insertions, 0 deletions
diff --git a/src/event/quic/ngx_event_quic_transport.c b/src/event/quic/ngx_event_quic_transport.c index 2c952177c..ad4758c60 100644 --- a/src/event/quic/ngx_event_quic_transport.c +++ b/src/event/quic/ngx_event_quic_transport.c @@ -742,6 +742,13 @@ ngx_quic_parse_frame(ngx_quic_header_t *pkt, u_char *start, u_char *end, return NGX_ERROR; } + if (varint > NGX_QUIC_FT_LAST) { + pkt->error = NGX_QUIC_ERR_FRAME_ENCODING_ERROR; + ngx_log_error(NGX_LOG_INFO, pkt->log, 0, + "quic unknown frame type 0x%xL", varint); + return NGX_ERROR; + } + f->type = varint; if (ngx_quic_frame_allowed(pkt, f->type) != NGX_OK) { diff --git a/src/event/quic/ngx_event_quic_transport.h b/src/event/quic/ngx_event_quic_transport.h index 2cda8088f..9fb621721 100644 --- a/src/event/quic/ngx_event_quic_transport.h +++ b/src/event/quic/ngx_event_quic_transport.h @@ -83,6 +83,8 @@ #define NGX_QUIC_FT_CONNECTION_CLOSE_APP 0x1D #define NGX_QUIC_FT_HANDSHAKE_DONE 0x1E +#define NGX_QUIC_FT_LAST NGX_QUIC_FT_HANDSHAKE_DONE + /* 22.4. QUIC Transport Error Codes Registry */ /* Keep in sync with ngx_quic_errors[] */ #define NGX_QUIC_ERR_NO_ERROR 0x00 |