forked from quic-go/quic-go
fix data length check in STREAM frame parser
We should check if the rest of the STREAM frame contains enough bytes to read the full data length, not if this overflows the MaxPacketSize (which is the maximum packet size we use for sending, and has nothing to do with receiving packets).
This commit is contained in:
@@ -61,8 +61,11 @@ func ParseStreamFrame(r *bytes.Reader, version protocol.VersionNumber) (*StreamF
|
||||
}
|
||||
}
|
||||
|
||||
if dataLen > uint16(protocol.MaxPacketSize) {
|
||||
return nil, qerr.Error(qerr.InvalidStreamData, "data len too large")
|
||||
// shortcut to prevent the unneccessary allocation of dataLen bytes
|
||||
// if the dataLen is larger than the remaining length of the packet
|
||||
// reading the packet contents would result in EOF when attempting to READ
|
||||
if int(dataLen) > r.Len() {
|
||||
return nil, io.EOF
|
||||
}
|
||||
|
||||
if !frame.DataLenPresent {
|
||||
@@ -72,6 +75,7 @@ func ParseStreamFrame(r *bytes.Reader, version protocol.VersionNumber) (*StreamF
|
||||
if dataLen != 0 {
|
||||
frame.Data = make([]byte, dataLen)
|
||||
if _, err := io.ReadFull(r, frame.Data); err != nil {
|
||||
// this should never happen, since we already checked the dataLen earlier
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,6 +2,7 @@ package wire
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"io"
|
||||
|
||||
"github.com/lucas-clemente/quic-go/internal/protocol"
|
||||
"github.com/lucas-clemente/quic-go/qerr"
|
||||
@@ -168,9 +169,9 @@ var _ = Describe("StreamFrame", func() {
|
||||
})
|
||||
|
||||
It("rejects frames to too large dataLen", func() {
|
||||
b := bytes.NewReader([]byte{0xa0, 0x1, 0xff, 0xf})
|
||||
b := bytes.NewReader([]byte{0xa0, 0x1, 0xff, 0xff})
|
||||
_, err := ParseStreamFrame(b, protocol.VersionWhatever)
|
||||
Expect(err).To(MatchError(qerr.Error(qerr.InvalidStreamData, "data len too large")))
|
||||
Expect(err).To(MatchError(io.EOF))
|
||||
})
|
||||
|
||||
It("rejects frames that overflow the offset", func() {
|
||||
|
||||
Reference in New Issue
Block a user