From: Sergey Kandaurov <pluknet@nginx.com>
Date: Fri, 5 Jun 2020 17:59:26 +0000 (+0300)
Subject: Reject invalid STREAM ID with STREAM_STATE_ERROR connection error.
X-Git-Tag: release-1.25.0~4^2~682
X-Git-Url: http://git.kaiwu.me/postgresql/log/contrib/postgres_fdw/static/gitweb.js?a=commitdiff_plain;h=d42354136031a3dfce5f7e5a857baae950c4fb14;p=nginx.git

Reject invalid STREAM ID with STREAM_STATE_ERROR connection error.
---

diff --git a/src/event/ngx_event_quic.c b/src/event/ngx_event_quic.c
index 376d1756b..cb0df3d5d 100644
--- a/src/event/ngx_event_quic.c
+++ b/src/event/ngx_event_quic.c
@@ -2598,12 +2598,24 @@ ngx_quic_handle_stream_frame(ngx_connection_t *c, ngx_quic_header_t *pkt,
     qc = c->quic;
     f = &frame->u.stream;
 
+    if ((f->stream_id & NGX_QUIC_STREAM_UNIDIRECTIONAL)
+        && (f->stream_id & NGX_QUIC_STREAM_SERVER_INITIATED))
+    {
+        qc->error = NGX_QUIC_ERR_STREAM_STATE_ERROR;
+        return NGX_ERROR;
+    }
+
     sn = ngx_quic_find_stream(&qc->streams.tree, f->stream_id);
 
     if (sn == NULL) {
         ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
                        "quic stream id 0x%xi is new", f->stream_id);
 
+        if (f->stream_id & NGX_QUIC_STREAM_SERVER_INITIATED) {
+            qc->error = NGX_QUIC_ERR_STREAM_STATE_ERROR;
+            return NGX_ERROR;
+        }
+
         n = (f->stream_id & NGX_QUIC_STREAM_UNIDIRECTIONAL)
             ? qc->tp.initial_max_stream_data_uni
             : qc->tp.initial_max_stream_data_bidi_remote;