From 00201ecd8f982da3b67d4f6868af72a1b03b14e0 Mon Sep 17 00:00:00 2001 From: Tatsuhiro Tsujikawa Date: Sat, 9 Mar 2024 16:26:42 +0900 Subject: [PATCH] Limit CONTINUATION frames following an incoming HEADER frame --- lib/includes/nghttp2/nghttp2.h | 7 ++++++- lib/nghttp2_helper.c | 2 ++ lib/nghttp2_session.c | 7 +++++++ lib/nghttp2_session.h | 10 ++++++++++ 4 files changed, 25 insertions(+), 1 deletion(-) Index: nghttp2-1.52.0/lib/includes/nghttp2/nghttp2.h =================================================================== --- nghttp2-1.52.0.orig/lib/includes/nghttp2/nghttp2.h +++ nghttp2-1.52.0/lib/includes/nghttp2/nghttp2.h @@ -440,7 +440,12 @@ typedef enum { * exhaustion on server side to send these frames forever and does * not read network. */ - NGHTTP2_ERR_FLOODED = -904 + NGHTTP2_ERR_FLOODED = -904, + /** + * When a local endpoint receives too many CONTINUATION frames + * following a HEADER frame. + */ + NGHTTP2_ERR_TOO_MANY_CONTINUATIONS = -905, } nghttp2_error; /** Index: nghttp2-1.52.0/lib/nghttp2_helper.c =================================================================== --- nghttp2-1.52.0.orig/lib/nghttp2_helper.c +++ nghttp2-1.52.0/lib/nghttp2_helper.c @@ -336,6 +336,8 @@ const char *nghttp2_strerror(int error_c "closed"; case NGHTTP2_ERR_TOO_MANY_SETTINGS: return "SETTINGS frame contained more than the maximum allowed entries"; + case NGHTTP2_ERR_TOO_MANY_CONTINUATIONS: + return "Too many CONTINUATION frames following a HEADER frame"; default: return "Unknown error code"; } Index: nghttp2-1.52.0/lib/nghttp2_session.c =================================================================== --- nghttp2-1.52.0.orig/lib/nghttp2_session.c +++ nghttp2-1.52.0/lib/nghttp2_session.c @@ -491,6 +491,7 @@ static int session_new(nghttp2_session * (*session_ptr)->max_send_header_block_length = NGHTTP2_MAX_HEADERSLEN; (*session_ptr)->max_outbound_ack = NGHTTP2_DEFAULT_MAX_OBQ_FLOOD_ITEM; (*session_ptr)->max_settings = NGHTTP2_DEFAULT_MAX_SETTINGS; + (*session_ptr)->max_continuations = NGHTTP2_DEFAULT_MAX_CONTINUATIONS; if (option) { if ((option->opt_set_mask & NGHTTP2_OPT_NO_AUTO_WINDOW_UPDATE) && @@ -6838,6 +6839,8 @@ ssize_t nghttp2_session_mem_recv(nghttp2 } } session_inbound_frame_reset(session); + + session->num_continuations = 0; } break; } @@ -6959,6 +6962,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2 } #endif /* DEBUGBUILD */ + if (++session->num_continuations > session->max_continuations) { + return NGHTTP2_ERR_TOO_MANY_CONTINUATIONS; + } + readlen = inbound_frame_buf_read(iframe, in, last); in += readlen; Index: nghttp2-1.52.0/lib/nghttp2_session.h =================================================================== --- nghttp2-1.52.0.orig/lib/nghttp2_session.h +++ nghttp2-1.52.0/lib/nghttp2_session.h @@ -105,6 +105,10 @@ typedef struct { /* The default value of maximum number of concurrent streams. */ #define NGHTTP2_DEFAULT_MAX_CONCURRENT_STREAMS 0xffffffffu +/* The default max number of CONTINUATION frames following an incoming + HEADER frame. */ +#define NGHTTP2_DEFAULT_MAX_CONTINUATIONS 8 + /* Internal state when receiving incoming frame */ typedef enum { /* Receiving frame header */ @@ -280,6 +284,12 @@ struct nghttp2_session { size_t max_send_header_block_length; /* The maximum number of settings accepted per SETTINGS frame. */ size_t max_settings; + /* The maximum number of CONTINUATION frames following an incoming + HEADER frame. */ + size_t max_continuations; + /* The number of CONTINUATION frames following an incoming HEADER + frame. This variable is reset when END_HEADERS flag is seen. */ + size_t num_continuations; /* Next Stream ID. Made unsigned int to detect >= (1 << 31). */ uint32_t next_stream_id; /* The last stream ID this session initiated. For client session,