BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached

qpack_decode_fs() parses the field section prefix but never looks at the
result. haproxy advertises a null dynamic table capacity, so a conformant
encoder cannot produce a non null Encoded Required Insert Count, and RFC 9204
4.5.1.1 asks for QPACK_DECOMPRESSION_FAILED in that case. It is now rejected.

Nothing could be done with the accepted prefix, as every field line
representation referencing the dynamic table is already rejected, so this is a
compliance fix rather than a security one.

This should be backported as far as 2.6.

diff --git a/src/qpack-dec.c b/src/qpack-dec.c
index 2f9d891a7aa4a2876f3e77b80877bded9133707e..4be5c9c602de4df609e22ae86762c5d19f48677a 100644 (file)
--- a/src/qpack-dec.c
+++ b/src/qpack-dec.c
@@ -298,6 +298,16 @@ int qpack_decode_fs(const unsigned char *raw, uint64_t len, struct buffer *tmp,
                goto out;
        }
 
+       /* RFC 9204 4.5.1.1
+        * haproxy advertises a null dynamic table capacity, so a conformant
+        * encoder cannot produce a non null Encoded Required Insert Count.
+        */
+       if (enc_ric) {
+               qpack_debug_printf(stderr, "##ERR@%d\n", __LINE__);
+               ret = -QPACK_RET_DECOMP;
+               goto out;
+       }
+
        chunk_reset(tmp);
        qpack_debug_printf(stderr, "enc_ric: %llu db: %llu s=%d\n", 
                           (unsigned long long)enc_ric, (unsigned long long)db, !!s);