fixes

Author: lws-team

include/libwebsockets/lws-context-vhost.h

@@ -1112,7 +1112,9 @@ struct lws_context_creation_info {
 	/**< VHOST: Comma-separated list of IPv4 and/or IPv6 preferred addresses (e.g., "1.2.3.4:443,[2001:db8::1]:443")
 	 * to send to the client during the handshake to facilitate Connection Migration. */
 
+#if !defined(__STRICT_ANSI__)
 	void *_unused[0]; /**< dummy */
+#endif
 };
 
 /**

include/libwebsockets/lws-lecp.h

@@ -290,6 +290,7 @@ struct lecp_ctx {
 	uint8_t			pst_sp; /* parsing stack head */
 	uint8_t			outer_array;
 	uint8_t			cbor_pos;
+	uint8_t			cbor_len;
 	uint8_t			literal_cbor_report;
 	char			present; /* temp for cb reason to use */
 

lib/cose/cose_sign.c

@@ -456,11 +456,10 @@ lws_cose_sign_payload_chunk(struct lws_cose_sign_context *csc,
 			lws_lec_printf(&lec, "{1:%lld}",
 					     (long long)csc->alg->cose_alg);
 
-			lws_lec_init(&lec1, lb, sizeof(lb));
-			lws_lec_int(&lec1, LWS_CBOR_MAJTYP_BSTR, 0,
-					lec.used);
-			if (lws_lec_printf(csc->info.lec, "{1:%lld}",
-					     (long long)csc->alg->cose_alg) != LWS_LECPCTX_RET_FINISHED)
+			lws_lec_scratch(&lec);
+
+			if (lws_lec_printf(csc->info.lec, "%.*b",
+					     (int)lec.used, lec.start) != LWS_LECPCTX_RET_FINISHED)
 				/* coverity */
 				return 0;
 			break;

lib/cose/cose_validate.c

@@ -947,13 +947,13 @@ cb_cose_sig(struct lecp_ctx *ctx, char reason)
 		case ST_OUTER_UNPROTECTED:
 			sl = &cps->st[cps->sp];
 			hi = ph_index(cps);
-			if (sl->ph_pos[hi] + 3 + ctx->cbor_pos >
+			if (sl->ph_pos[hi] + 3 + ctx->cbor_len >
 					(int)sizeof(sl->ph[hi]) - 3)
 				/* more protected cbor than we can handle */
 				goto bail;
 			memcpy(sl->ph[hi] + 3 + sl->ph_pos[hi], ctx->cbor,
-			       ctx->cbor_pos);
-			sl->ph_pos[hi] += ctx->cbor_pos;
+			       ctx->cbor_len);
+			sl->ph_pos[hi] += ctx->cbor_len;
 			break;
 		}
 	}

lib/misc/lecp.c

@@ -325,6 +325,7 @@ report_raw_cbor(struct lecp_ctx *ctx)
 	if (!ctx->cbor_pos)
 		return 0;
 
+	ctx->cbor_len = ctx->cbor_pos;
 	ctx->cbor_pos = 0;                /* reset BEFORE callback */
 
 	if (pst->cb(ctx, LECPCB_LITERAL_CBOR))

lib/roles/quic/ops-quic.c

@@ -841,16 +841,22 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
                                                 if (sa.sa4.sin_family == AF_INET) {
                                                         sa4 = sa;
                                                         sa4.sa4.sin_port = htons((uint16_t)port);
+#if defined(LWS_WITH_IPV6)
                                                 } else {
                                                         sa6 = sa;
                                                         sa6.sa6.sin6_port = htons((uint16_t)port);
+#endif
                                                 }
                                         }
                                         p = comma ? comma + 1 : NULL;
                                 }
 
                                 /* We only send preferred_address if we have a valid address */
+#if defined(LWS_WITH_IPV6)
                                 if (sa4.sa4.sin_family == AF_INET || sa6.sa6.sin6_family == AF_INET6) {
+#else
+                                if (sa4.sa4.sin_family == AF_INET) {
+#endif
                                         uint8_t pref_buf[128];
                                         uint8_t *pb = pref_buf;
 
@@ -863,12 +869,16 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
                                         }
 
                                         /* IPv6 (16 bytes addr, 2 bytes port) */
+#if defined(LWS_WITH_IPV6)
                                         if (sa6.sa6.sin6_family == AF_INET6) {
                                                 memcpy(pb, sa6.sa6.sin6_addr.s6_addr, 16); pb += 16;
                                                 memcpy(pb, &sa6.sa6.sin6_port, 2); pb += 2;
                                         } else {
                                                 memset(pb, 0, 18); pb += 18;
                                         }
+#else
+                                        memset(pb, 0, 18); pb += 18;
+#endif
 
                                         /* CID Length (1 byte) */
                                         *pb++ = 8; /* Generating an 8-byte CID */

lib/roles/quic/parse-quic.c

@@ -568,6 +568,11 @@ lws_quic_parse_frames(struct lws *nwsi, int level, uint8_t *payload, size_t payl
 			pn -= (first_ack_range + 1);
 
 			/* 5. Additional ACK Ranges */
+			if (ack_range_count > (payload_len - pos) / 2) {
+				lws_quic_enter_closing_state(nwsi, LWS_QUIC_ERR_FRAME_ENCODING_ERROR, type, 0);
+				return -1;
+			}
+
 			for (uint64_t r = 0; r < ack_range_count; r++) {
 				uint64_t gap, ack_range;
 
@@ -885,8 +890,10 @@ lws_quic_parse_frames(struct lws *nwsi, int level, uint8_t *payload, size_t payl
 							/* Transition new nwsi to established state and cancel its timeout/grace timers */
 							lwsi_set_state(nwsi, LRS_ESTABLISHED);
 							lws_set_timeout(nwsi, NO_PENDING_TIMEOUT, 0);
+#if defined(LWS_WITH_CLIENT)
 							lws_sul_cancel(&nwsi->sul_h3_grace);
 							lws_sul_cancel(&nwsi->sul_happy_eyeballs);
+#endif
 							lws_sul_cancel(&nwsi->sul_connect_timeout);
 
 							/* Reparent all child streams to the new nwsi */

lib/tls/gnutls/gnutls-session.c

@@ -194,10 +194,12 @@ lws_tls_session_new_gnutls(struct lws *wsi)
 
 	nl = strlen(buf);
 
+#if (_LWS_ENABLED_LOGS & LLL_NOTICE)
 	/* Check if a session ticket has actually been received (TLS 1.3 requirement) */
 	unsigned sess_flags = gnutls_session_get_flags((gnutls_session_t)wsi->tls.ssl);
 	lwsl_notice("%s: QUIC session ticket check: flags=0x%x, has_ticket=%d\n", __func__,
 		    sess_flags, !!(sess_flags & GNUTLS_SFLAGS_SESSION_TICKET));
+#endif
 
 	int ret = gnutls_session_get_data2((gnutls_session_t)wsi->tls.ssl, &gd);
 	lwsl_notice("%s: gnutls_session_get_data2 ret=%d, len=%u\n", __func__, ret, gd.size);

lib/tls/gnutls/gnutls-tls.c

@@ -336,10 +336,15 @@ int
 lws_tls_server_new_nonblocking(struct lws *wsi, lws_sockfd_type accept_fd)
 {
 	gnutls_session_t session;
-
 	unsigned int flags = GNUTLS_SERVER;
+
+	if (!wsi->a.vhost) {
+		lwsl_err("%s: NULL vhost\n", __func__);
+		return 1;
+	}
+
 #if GNUTLS_VERSION_NUMBER >= 0x030605
-        if (wsi->a.vhost && (wsi->a.vhost->options & LWS_SERVER_OPTION_ALLOW_EARLY_DATA)) {
+        if (wsi->a.vhost->options & LWS_SERVER_OPTION_ALLOW_EARLY_DATA) {
                 flags |= GNUTLS_ENABLE_EARLY_DATA;
 #if defined(LWS_ROLE_QUIC) && GNUTLS_VERSION_NUMBER >= 0x030702
                 extern const struct lws_role_ops role_ops_quic;
@@ -493,7 +498,7 @@ lws_ssl_client_bio_create(struct lws *wsi)
 void
 lws_ssl_SSL_CTX_destroy(struct lws_vhost *vhost)
 {
-#if GNUTLS_VERSION_NUMBER >= 0x030605
+#if defined(LWS_WITH_SERVER) && GNUTLS_VERSION_NUMBER >= 0x030605
         if (vhost->tls.anti_replay) {
                 lws_dll2_owner_t *owner = (lws_dll2_owner_t *)vhost->tls.anti_replay_owner;
                 if (owner) {

minimal-examples-lowlevel/http-client/minimal-http-client-multi/minimal-http-client-multi.c

@@ -749,10 +749,10 @@ int main(int argc, const char **argv)
          */
         if (testcase && !strcmp(testcase, "zerortt")) {
                 if (!save_ticket[0])
-                        lws_strncpy(save_ticket, "/tmp/lws_session_ticket",
+                        lws_strncpy(save_ticket, "./lws_session_ticket",
                                     sizeof(save_ticket));
                 if (!load_ticket[0])
-                        lws_strncpy(load_ticket, "/tmp/lws_session_ticket",
+                        lws_strncpy(load_ticket, "./lws_session_ticket",
                                     sizeof(load_ticket));
                 lwsl_notice("%s: TESTCASE=zerortt: ticket path '%s'\n",
                             __func__, save_ticket);