]>
git.kaiwu.me - haproxy.git/commit
BUG/MINOR: qpack: missing shift count check in qpack_get_varint() (UB)
Parsing QPACK varints with excessive continuation bytes increases shift
by 7 on each iteration. When shift reaches 63 or higher, evaluating:
(v & 127) > (limit - ret) >> shift
executes a bitwise shift on a 64-bit integer with an out-of-range count,
which is Undefined Behavior in C.
Fix this by jumping to too_large label if shift >= 63 before the shift runs.
Thank you to @OneZ3r0 for having reported this issue.
Should be backported to all versions.