BUG/MINOR: h3: enforce maxrewrite on request headers

Muxes are responsible to ensure that at least maxrewrite space remains
in the stream buffer after headers decoding. This was missing in HTTP/3
decoder.

Add an extra check on maxrewrite size after H3 HEADERS request decoding.
The connection is closed with INTERNAL_ERROR if on excess. A future
patch may implement stream-level error instead.

This should be backported up to 2.6.

diff --git a/src/h3.c b/src/h3.c
index 9ec89e750aff49f6195e38c40712b134dbc480ea..ed6463374f7518804668d1d6facfb9371e38824a 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -1174,6 +1174,13 @@ static ssize_t h3_req_headers_to_htx(struct qcs *qcs, const struct buffer *buf,
        if (fin)
                htx_set_eom(htx);
 
+       /* Check that at least reserved space remains after headers decoding. */
+       if (htx_free_space(htx) < global.tune.maxrewrite) {
+               /* TODO should be a stream level error instead of a connection one. */
+               len = -1;
+               goto out;
+       }
+
        htx_to_buf(htx, &htx_buf);
        htx = NULL;