HPACKDecoder: reject more than two table size updates per header block (#551)

RFC 7541 § 4.2 specifies that an encoder emits at most two dynamic table
size updates between two header blocks (the smallest size reached, then
the final size). The decoder enforced placement - updates must precede
the first header - but put no upper bound on their count, so a block of
arbitrarily many 0x20 bytes followed by a header was accepted. This is a
conformance gap. It is not a DoS: setting an already-empty table to 0 is
O(1).

Modifications:

- Count consecutive table size updates in decodeHeaders(from:) and throw
IllegalDynamicTableSizeChange once a third is seen.
- Extend the existing § 4.2 comment to cite the at-most-two rule.
- Add tests covering the two-accepted and three-rejected cases.

Result:

Header blocks with more than two dynamic table size updates are rejected
as malformed, matching RFC 7541 § 4.2.

Co-authored-by: George Barnett <gbarnett@apple.com>

Author: sour-exploit

Sources/NIOHPACK/HPACKDecoder.swift

@@ -122,19 +122,32 @@ public struct HPACKDecoder: Sendable {
             headers.reserveCapacity(16)
 
             var listSize = 0
+            var tableSizeUpdates = 0
 
             while buffer.readableBytes > 0 {
                 switch try self.decodeHeader(from: &buffer) {
                 case .tableSizeChange:
                     // RFC 7541 § 4.2 <https://httpwg.org/specs/rfc7541.html#maximum.table.size>:
                     //
+                    // 1. "In the case that this size is changed more than once in [the interval between two
+                    //    header blocks], the smallest maximum table size that occurs in that interval MUST be
+                    //    signaled in a dynamic table size update. The final maximum size is always signaled,
+                    //    resulting in at most two dynamic table size updates."
+                    //
                     // 2. "This dynamic table size update MUST occur at the beginning of the first header block
                     //    following the change to the dynamic table size."
                     guard headers.count == 0 else {
                         // If our decode buffer has any data in it, then this is out of place.
                         // Treat it as an invalid input
                         throw NIOHPACKErrors.IllegalDynamicTableSizeChange()
                     }
+
+                    // A conformant encoder emits at most two consecutive table size updates (see point 1
+                    // above). More than two is never valid, so reject the block as malformed.
+                    tableSizeUpdates += 1
+                    guard tableSizeUpdates <= 2 else {
+                        throw NIOHPACKErrors.IllegalDynamicTableSizeChange()
+                    }
                 case .header(let header):
                     listSize += header.size
                     guard listSize <= self.maxHeaderListSize else {

Tests/NIOHPACKTests/HPACKCodingTests.swift

@@ -551,6 +551,28 @@ class HPACKCodingTests: XCTestCase {
         }
     }
 
+    func testAcceptsTwoConsecutiveTableSizeUpdates() throws {
+        // Two dynamic-table-size updates (0x20 == update to 0) at the start of a header block, followed
+        // by an indexed header field (0x82 == static index 2, ":method: GET"). RFC 7541 § 4.2 permits up
+        // to two table size updates per header block, so this must decode successfully.
+        var request = buffer(wrapping: [0x20, 0x20, 0x82])
+        var decoder = HPACKDecoder(allocator: ByteBufferAllocator())
+
+        let decoded = try decoder.decodeHeaders(from: &request)
+        XCTAssertEqual(decoded, HPACKHeaders([(":method", "GET")]))
+    }
+
+    func testRejectsMoreThanTwoConsecutiveTableSizeUpdates() throws {
+        // Three dynamic-table-size updates (0x20) before the first header. RFC 7541 § 4.2 caps a header
+        // block at two table size updates, so the decoder must reject the block as malformed.
+        var request = buffer(wrapping: [0x20, 0x20, 0x20, 0x82])
+        var decoder = HPACKDecoder(allocator: ByteBufferAllocator())
+
+        XCTAssertThrowsError(try decoder.decodeHeaders(from: &request)) { error in
+            XCTAssertTrue(error is NIOHPACKErrors.IllegalDynamicTableSizeChange)
+        }
+    }
+
     func testHPACKHeadersDescription() throws {
         let headerList1: [(String, String)] = [
             (":method", "GET"),