tree b8f4a8a7395a0830012af8e3a67f8a8f3c2bf0db
parent 2263fcf0251337a45c54e7c59bd807044eb11541
author Eli Lipsitz <elipsitz@pigweed.infra.roller.google.com> 1718746290 +0000
committer CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> 1718746290 +0000

roll: pw_toolchain, pw_toolchain: pw_grpc: Avoid buffer overflow when processing corrupt frames

HTTP2 HEADERS and DATA frames are variable-length frames, that include
flags that enable certain features that take up space in the frame: e.g.
a "padding" bit that adds a 1-byte "padding" field, or a "priority" flag
that adds a 5-byte "priority" field.

The handlers for these frames did not verify the size of the frame
payloads when reading these optional fields, if present. Thus, an
undersized frame that had these flag bits set would lead to a buffer
overread.

This commit improves the handlers to explicitly check the frame sizes,
and send the appropriate connection errors (according to the RFC) if
they occur, without reading past the end of the payload buffer.
If this occurs, it's almost certainly due to some underlying transport
corruption.

Original-Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/216651
Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com>

https://pigweed.googlesource.com/pigweed/pigweed
pw_toolchain, pw_toolchain Rolled-Commits: 9650f5fcbae1ea3..49d5876907ba804
Roller-URL: https://ci.chromium.org/b/8744757712942869777
GitWatcher: ignore
CQ-Do-Not-Cancel-Tryjobs: true
Change-Id: I2a74e69fbffecdca4ba419706f89395dc6bd1a40
Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/quickstart/bazel/+/216816
Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com>
Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com>
Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com>