65 lines
2.2 KiB
Diff
65 lines
2.2 KiB
Diff
|
From 8907dedc858cc344d770a2e826d6acc516429540 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Marc Mutz <marc.mutz@qt.io>
|
||
|
|
Date: Tue, 19 Dec 2023 14:22:37 +0100
|
||
|
|
Subject: [PATCH] Http2: fix potential overflow in assemble_hpack_block()
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
The function is given a vector of Http2::Frame's and flattens it into
|
||
|
|
a vector<uchar>. While each Frame can contain a maximum of 16GiB of
|
||
|
|
data (24-bit size field), one "only" needs 257 of them to overflow the
|
||
|
|
quint32 variable's range.
|
||
|
|
|
||
|
|
So make sure any overflow does not go undetected.
|
||
|
|
|
||
|
|
Keep the limited uint32_t range for now, as we don't know whether all
|
||
|
|
consumers of the result can deal with more than 4GiB of data.
|
||
|
|
|
||
|
|
Since all these frames must be in memory, this cannot overflow in
|
||
|
|
practice on 32-bit machines.
|
||
|
|
|
||
|
|
Pick-to: 6.7 6.6 6.5 6.2 5.15
|
||
|
|
Change-Id: Iafaa7d1c870cba9100e75065db11d95934f86213
|
||
|
|
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
|
||
|
|
(cherry picked from commit 1e6bb61af3ae29755f93b92f157df026f934ae61)
|
||
|
|
|
||
|
|
* asturmlechner 2024-01-02: Use correct include for 5.15
|
||
|
|
---
|
||
|
|
src/network/access/qhttp2protocolhandler.cpp | 8 ++++++--
|
||
|
|
1 file changed, 6 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/src/network/access/qhttp2protocolhandler.cpp b/src/network/access/qhttp2protocolhandler.cpp
|
||
|
|
index 39dd460881a..ead88d781ae 100644
|
||
|
|
--- a/src/network/access/qhttp2protocolhandler.cpp
|
||
|
|
+++ b/src/network/access/qhttp2protocolhandler.cpp
|
||
|
|
@@ -10,10 +10,12 @@
|
||
|
|
#include <private/qnoncontiguousbytedevice_p.h>
|
||
|
|
|
||
|
|
#include <QtNetwork/qabstractsocket.h>
|
||
|
|
+
|
||
|
|
#include <QtCore/qloggingcategory.h>
|
||
|
|
#include <QtCore/qendian.h>
|
||
|
|
#include <QtCore/qdebug.h>
|
||
|
|
#include <QtCore/qlist.h>
|
||
|
|
+#include <QtCore/private/qnumeric_p.h>
|
||
|
|
#include <QtCore/qurl.h>
|
||
|
|
|
||
|
|
#include <qhttp2configuration.h>
|
||
|
|
@@ -90,8 +92,10 @@ std::vector<uchar> assemble_hpack_block(const std::vector<Http2::Frame> &frames)
|
||
|
|
std::vector<uchar> hpackBlock;
|
||
|
|
|
||
|
|
quint32 total = 0;
|
||
|
|
- for (const auto &frame : frames)
|
||
|
|
- total += frame.hpackBlockSize();
|
||
|
|
+ for (const auto &frame : frames) {
|
||
|
|
+ if (add_overflow(total, frame.hpackBlockSize(), &total))
|
||
|
|
+ return hpackBlock;
|
||
|
|
+ }
|
||
|
|
|
||
|
|
if (!total)
|
||
|
|
return hpackBlock;
|
||
|
|
--
|
||
|
|
GitLab
|
||
|
|
|