Skip to content

x/net/http2: zero-length payload HEADERS frame causes PROTOCOL_ERROR #109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

Conversation

zliu5-sc
Copy link

As per RFC7540 Section 6.2:

Padding that exceeds the size remaining for the header block fragment MUST be treated as a PROTOCOL_ERROR.

(emphasis added)

Hence the existing check if len(p)-int(padLength) <= 0 is incorrect
since = would have flagged paddings that is exactly the size
remaining. The existing check also triggers false positives when the
HEADERS frame has a payload size of 0 and no padding (0 - 0 <= 0).

Fixes golang/go#47851

As per [RFC7540 Section 6.2](https://httpwg.org/specs/rfc7540.html#HEADERS):

> Padding that *exceeds* the size remaining for the header block fragment MUST be treated as a PROTOCOL_ERROR.

(emphasis added)

Hence the existing check `if len(p)-int(padLength) <= 0` is incorrect
since `=` would have flagged paddings that is *exactly* the size
remaining. The existing check also triggers false positives when the
HEADERS frame has a payload size of 0 and no padding (0 - 0 <= 0).

Fixes golang/go#47851
@google-cla
Copy link

google-cla bot commented Aug 20, 2021

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.


What to do if you already signed the CLA

Individual signers
Corporate signers

ℹ️ Googlers: Go here for more info.

@google-cla google-cla bot added the cla: no label Aug 20, 2021
@zliu5-sc
Copy link
Author

close in favor of https://golang.org/cl/344029

@zliu5-sc zliu5-sc closed this Aug 20, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

x/net/http2: zero-length payload HEADERS frame causes PROTOCOL_ERROR
1 participant