BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure

In quic_build_post_handshake_frames(), the NEW_TOKEN frame is appended to the
local frame list only after its token is generated. The error path taken when
quic_generate_token() fails frees that list, and therefore never sees the frame.
This only happens on a memory allocation failure, when the AEAD context used to
cipher the token cannot be created.

Append the frame as soon as it is allocated, as done just above for the
HANDSHAKE_DONE frame.

This bug was introduced by commit f627b9272 ("BUG/MEDIUM: quic: always validate
sender address on 0-RTT").

This should be backported as far as 3.0.

diff --git a/src/quic_conn.c b/src/quic_conn.c
index 15ab7857a24bd0e197f56574e941ad6b36ac82c1..1f435a44dc3edb7006181590ee96ae99383fc780 100644 (file)
--- a/src/quic_conn.c
+++ b/src/quic_conn.c
@@ -465,6 +465,8 @@ int quic_build_post_handshake_frames(struct quic_conn *qc,
                        goto err;
                }
 
+               LIST_APPEND(&frm_list, &frm->list);
+
                new_token_frm_len =
                        quic_generate_token(frm->new_token.w_data,
                                            sizeof(frm->new_token.w_data), &qc->peer_addr);
@@ -475,7 +477,6 @@ int quic_build_post_handshake_frames(struct quic_conn *qc,
 
                BUG_ON(new_token_frm_len != sizeof(frm->new_token.w_data));
                frm->new_token.len = new_token_frm_len;
-               LIST_APPEND(&frm_list, &frm->list);
        }
 
        /* Initialize <max> connection IDs minus one: there is