BUG/MINOR: h3: close connection on GOAWAY frame too long

GOAWAY frame contains a single stream ID varint. When decoding it,
ensure its length match the announced value in frame header. If not the
case, the connection must be closed with code FRAME_ERROR.

This must be backported up to 3.4.

diff --git a/src/h3.c b/src/h3.c
index c0d310d96811cb67bb00af15e82dc415cfa00a0d..60b83e5c932e0d44bd71515f4b3e371e66a308a7 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -1862,6 +1862,13 @@ static ssize_t h3_parse_goaway_frm(struct h3c *h3c, const struct buffer *buf,
                return -1;
        }
 
+       if (ret != len) {
+               TRACE_ERROR("mismatch on GOAWAY frame length", H3_EV_RX_FRAME, h3c->qcc->conn);
+               h3c->err = H3_ERR_FRAME_ERROR;
+               qcc_report_glitch(h3c->qcc, 1);
+               return -1;
+       }
+
        if ((h3c->flags & H3_CF_GOAWAY_RECV) && id > h3c->id_shut_r) {
                h3c->err = H3_ERR_ID_ERROR;
                qcc_report_glitch(h3c->qcc, 1);