Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.5:Update
nghttp2.33194
nghttp2-CVE-2024-28182-1.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File nghttp2-CVE-2024-28182-1.patch of Package nghttp2.33194
From 9cf6fa69aff88351760a4a55c6d2290a551adfaa Mon Sep 17 00:00:00 2001 From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> Date: Sat, 9 Mar 2024 16:26:42 +0900 Subject: [PATCH 1/2] Limit CONTINUATION frames following an incoming HEADER frame --- lib/includes/nghttp2/nghttp2.h | 7 ++++++- lib/nghttp2_helper.c | 2 ++ lib/nghttp2_session.c | 7 +++++++ lib/nghttp2_session.h | 10 ++++++++++ 4 files changed, 25 insertions(+), 1 deletion(-) Index: nghttp2-1.40.0/lib/includes/nghttp2/nghttp2.h =================================================================== --- nghttp2-1.40.0.orig/lib/includes/nghttp2/nghttp2.h +++ nghttp2-1.40.0/lib/includes/nghttp2/nghttp2.h @@ -440,7 +440,12 @@ typedef enum { * exhaustion on server side to send these frames forever and does * not read network. */ - NGHTTP2_ERR_FLOODED = -904 + NGHTTP2_ERR_FLOODED = -904, + /** + * When a local endpoint receives too many CONTINUATION frames + * following a HEADER frame. + */ + NGHTTP2_ERR_TOO_MANY_CONTINUATIONS = -905, } nghttp2_error; /** Index: nghttp2-1.40.0/lib/nghttp2_helper.c =================================================================== --- nghttp2-1.40.0.orig/lib/nghttp2_helper.c +++ nghttp2-1.40.0/lib/nghttp2_helper.c @@ -336,6 +336,8 @@ const char *nghttp2_strerror(int error_c "closed"; case NGHTTP2_ERR_TOO_MANY_SETTINGS: return "SETTINGS frame contained more than the maximum allowed entries"; + case NGHTTP2_ERR_TOO_MANY_CONTINUATIONS: + return "Too many CONTINUATION frames following a HEADER frame"; default: return "Unknown error code"; } Index: nghttp2-1.40.0/lib/nghttp2_session.c =================================================================== --- nghttp2-1.40.0.orig/lib/nghttp2_session.c +++ nghttp2-1.40.0/lib/nghttp2_session.c @@ -464,6 +464,7 @@ static int session_new(nghttp2_session * (*session_ptr)->max_send_header_block_length = NGHTTP2_MAX_HEADERSLEN; (*session_ptr)->max_outbound_ack = NGHTTP2_DEFAULT_MAX_OBQ_FLOOD_ITEM; (*session_ptr)->max_settings = NGHTTP2_DEFAULT_MAX_SETTINGS; + (*session_ptr)->max_continuations = NGHTTP2_DEFAULT_MAX_CONTINUATIONS; if (option) { if ((option->opt_set_mask & NGHTTP2_OPT_NO_AUTO_WINDOW_UPDATE) && @@ -6319,6 +6320,8 @@ ssize_t nghttp2_session_mem_recv(nghttp2 } } session_inbound_frame_reset(session); + + session->num_continuations = 0; } break; } @@ -6440,6 +6443,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2 } #endif /* DEBUGBUILD */ + if (++session->num_continuations > session->max_continuations) { + return NGHTTP2_ERR_TOO_MANY_CONTINUATIONS; + } + readlen = inbound_frame_buf_read(iframe, in, last); in += readlen; Index: nghttp2-1.40.0/lib/nghttp2_session.h =================================================================== --- nghttp2-1.40.0.orig/lib/nghttp2_session.h +++ nghttp2-1.40.0/lib/nghttp2_session.h @@ -107,6 +107,10 @@ typedef struct { #define NGHTTP2_DEFAULT_STREAM_RESET_BURST 1000 #define NGHTTP2_DEFAULT_STREAM_RESET_RATE 33 +/* The default max number of CONTINUATION frames following an incoming + HEADER frame. */ +#define NGHTTP2_DEFAULT_MAX_CONTINUATIONS 8 + /* Internal state when receiving incoming frame */ typedef enum { /* Receiving frame header */ @@ -279,6 +283,12 @@ struct nghttp2_session { size_t max_send_header_block_length; /* The maximum number of settings accepted per SETTINGS frame. */ size_t max_settings; + /* The maximum number of CONTINUATION frames following an incoming + HEADER frame. */ + size_t max_continuations; + /* The number of CONTINUATION frames following an incoming HEADER + frame. This variable is reset when END_HEADERS flag is seen. */ + size_t num_continuations; /* Next Stream ID. Made unsigned int to detect >= (1 << 31). */ uint32_t next_stream_id; /* The last stream ID this session initiated. For client session,
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor