]> git.kaiwu.me - haproxy.git/commit
projects / haproxy.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 0fa14a6) | patch
BUG/MEDIUM: h3: fix use-after-free on mux Rx buffer wrapping
authorAmaury Denoyelle <adenoyelle@haproxy.com>
Wed, 27 Apr 2022 12:41:53 +0000 (14:41 +0200)
committerAmaury Denoyelle <adenoyelle@haproxy.com>
Thu, 28 Apr 2022 13:18:20 +0000 (15:18 +0200)
commit30f23f53d237ade95910352922a4b17d5b358fa8
treecbfd5687380dc8c94537ed85721e4c09c528f5d7tree | snapshot
parent0fa14a69e85d027acc43615a496a7576d1a707b7commit | diff
BUG/MEDIUM: h3: fix use-after-free on mux Rx buffer wrapping

Handle wrapping buffer in h3_data_to_htx(). If data is wrapping, first
copy the contiguous data, then copy the data in front of the buffer.

Note that h3_headers_to_htx() is not able to handle wrapping data. For
the moment, a BUG_ON was added as a reminder. This cas never happened,
most probably because HEADERS is the first frame of the stream.
src/h3.c diff | blob | history
haproxy upstream