Skip to content

Commit 7e75c17

Browse files
lws-teamlws-team
committed
cov2
1 parent 092a554 commit 7e75c17

6 files changed

Lines changed: 35 additions & 59 deletions

File tree

‎lib/core-net/adopt.c‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -808,6 +808,7 @@ lws_create_adopt_udp2(struct lws *wsi, const char *ads,
808808
if (lws_plat_apply_FD_CLOEXEC((int)sock.sockfd) ||
809809
lws_plat_set_nonblocking(sock.sockfd)) {
810810
compatible_close(sock.sockfd);
811+
sock.sockfd = LWS_SOCK_INVALID;
811812
goto resume;
812813
}
813814

@@ -846,6 +847,7 @@ lws_create_adopt_udp2(struct lws *wsi, const char *ads,
846847
if (opaque &&
847848
lws_plat_BINDTODEVICE(sock.sockfd, (const char *)opaque)) {
848849
compatible_close(sock.sockfd);
850+
sock.sockfd = LWS_SOCK_INVALID;
849851
goto resume;
850852
}
851853

@@ -858,6 +860,7 @@ lws_create_adopt_udp2(struct lws *wsi, const char *ads,
858860
) == -1) {
859861
lwsl_err("%s: bind failed\n", __func__);
860862
compatible_close(sock.sockfd);
863+
sock.sockfd = LWS_SOCK_INVALID;
861864
goto resume;
862865
}
863866

@@ -972,8 +975,11 @@ lws_create_adopt_udp2(struct lws *wsi, const char *ads,
972975
goto bail;
973976

974977
if (lws_plat_apply_FD_CLOEXEC((int)sock.sockfd) ||
975-
lws_plat_set_nonblocking(sock.sockfd))
978+
lws_plat_set_nonblocking(sock.sockfd)) {
979+
compatible_close(sock.sockfd);
980+
sock.sockfd = LWS_SOCK_INVALID;
976981
goto resume;
982+
}
977983

978984
#if defined(LWS_WITH_IPV6) && defined(IPV6_V6ONLY)
979985
if (dest.sa4.sin_family == AF_INET6 &&

‎lib/roles/h3/qpack.c‎

Lines changed: 5 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -249,11 +249,14 @@ lws_qpack_encode_string(unsigned char *buf, size_t buf_len, const char *str, siz
249249
return (int)(pos + len);
250250
}
251251

252+
#if 0
252253
static struct lws_qpack_tx_table_entry *
253254
lws_qpack_tx_find(struct lws_qpack_tx_encoder *enc, const char *name, size_t name_len, const char *val, size_t val_len);
254255

255256
static int
256257
lws_qpack_tx_insert(struct lws_qpack_tx_encoder *enc, const char *name, size_t name_len, const char *val, size_t val_len, int static_name_idx);
258+
#endif
259+
257260

258261
LWS_VISIBLE int
259262
lws_qpack_encode_prefix(unsigned char *buf, size_t buf_len, uint64_t ric, uint64_t base, uint64_t max_entries)
@@ -344,7 +347,6 @@ lws_add_http3_header_by_name(struct lws *wsi, const unsigned char *name,
344347
int name_len = (int)strlen((const char *)name);
345348
int n;
346349
char lower_name[256];
347-
struct lws_qpack_tx_encoder *enc = wsi ? wsi->h3.qpack_tx_encoder : NULL;
348350

349351
if (name_len && name[name_len - 1] == ':')
350352
name_len--;
@@ -354,30 +356,6 @@ lws_add_http3_header_by_name(struct lws *wsi, const unsigned char *name,
354356
lower_name[n] = (char)tolower((int)name[n]);
355357
lower_name[name_len] = '\0';
356358

357-
if (enc) {
358-
struct lws_qpack_tx_table_entry *dte = lws_qpack_tx_find(enc, lower_name, (size_t)name_len, (const char *)value, (size_t)length);
359-
if (dte) {
360-
if (dte->insert_index + 1 > wsi->http.h3_req_ric)
361-
wsi->http.h3_req_ric = dte->insert_index + 1;
362-
n = lws_qpack_tx_encode_dynamic_index(*p, lws_ptr_diff_size_t(end, *p), dte->insert_index, wsi->http.h3_base);
363-
if (n >= 0) {
364-
*p += n;
365-
return 0;
366-
}
367-
}
368-
369-
int new_idx = lws_qpack_tx_insert(enc, lower_name, (size_t)name_len, (const char *)value, (size_t)length, -1);
370-
if (new_idx >= 0) {
371-
if ((uint32_t)new_idx + 1 > wsi->http.h3_req_ric)
372-
wsi->http.h3_req_ric = (uint32_t)new_idx + 1;
373-
n = lws_qpack_tx_encode_dynamic_name_ref(*p, lws_ptr_diff_size_t(end, *p), (uint32_t)new_idx, wsi->http.h3_base, (const char *)value, (size_t)length);
374-
if (n >= 0) {
375-
*p += n;
376-
return 0;
377-
}
378-
}
379-
}
380-
381359
n = lws_qpack_encode_literal_with_literal_name(*p, lws_ptr_diff_size_t(end, *p), lower_name, (size_t)name_len, (const char *)value, (size_t)length);
382360
if (n < 0) return 1;
383361
*p += n;
@@ -391,7 +369,6 @@ lws_add_http3_header_by_token(struct lws *wsi, enum lws_token_indexes token,
391369
unsigned char **p, unsigned char *end)
392370
{
393371
int static_idx = lws_qpack_find_static_index((int)token, (const char *)value, length);
394-
struct lws_qpack_tx_encoder *enc = wsi ? wsi->h3.qpack_tx_encoder : NULL;
395372
int n;
396373

397374
if (static_idx != -1) {
@@ -400,25 +377,6 @@ lws_add_http3_header_by_token(struct lws *wsi, enum lws_token_indexes token,
400377
if (static_val && length == (int)strlen(static_val) && !strncmp(static_val, (const char *)value, (size_t)length)) {
401378
n = lws_qpack_encode_static(*p, lws_ptr_diff_size_t(end, *p), static_idx);
402379
} else {
403-
if (enc) {
404-
const unsigned char *name = lws_token_to_string(token);
405-
if (name) {
406-
int name_len = (int)strlen((const char *)name);
407-
if (name_len && name[name_len - 1] == ':') name_len--;
408-
struct lws_qpack_tx_table_entry *dte = lws_qpack_tx_find(enc, (const char *)name, (size_t)name_len, (const char *)value, (size_t)length);
409-
if (dte) {
410-
if (dte->insert_index + 1 > wsi->http.h3_req_ric) wsi->http.h3_req_ric = dte->insert_index + 1;
411-
n = lws_qpack_tx_encode_dynamic_index(*p, lws_ptr_diff_size_t(end, *p), dte->insert_index, wsi->http.h3_base);
412-
if (n >= 0) { *p += n; return 0; }
413-
}
414-
int new_idx = lws_qpack_tx_insert(enc, (const char *)name, (size_t)name_len, (const char *)value, (size_t)length, static_idx);
415-
if (new_idx >= 0) {
416-
if ((uint32_t)new_idx + 1 > wsi->http.h3_req_ric) wsi->http.h3_req_ric = (uint32_t)new_idx + 1;
417-
n = lws_qpack_tx_encode_dynamic_name_ref(*p, lws_ptr_diff_size_t(end, *p), (uint32_t)new_idx, wsi->http.h3_base, (const char *)value, (size_t)length);
418-
if (n >= 0) { *p += n; return 0; }
419-
}
420-
}
421-
}
422380
n = lws_qpack_encode_literal_with_name_ref(*p, lws_ptr_diff_size_t(end, *p), static_idx, (const char *)value, (size_t)length);
423381
}
424382
} else {
@@ -1273,6 +1231,7 @@ lws_qpack_tx_encode_dynamic_name_ref(unsigned char *buf, size_t buf_len, uint32_
12731231
return ret + n;
12741232
}
12751233

1234+
#if 0
12761235
static struct lws_qpack_tx_table_entry *
12771236
lws_qpack_tx_find(struct lws_qpack_tx_encoder *enc, const char *name, size_t name_len, const char *val, size_t val_len)
12781237
{
@@ -1383,6 +1342,7 @@ lws_qpack_tx_insert(struct lws_qpack_tx_encoder *enc, const char *name, size_t n
13831342

13841343
return (int)dte->insert_index;
13851344
}
1345+
#endif
13861346

13871347
LWS_VISIBLE void
13881348
lws_qpack_tx_encoder_destroy(struct lws_qpack_tx_encoder *enc)

‎lib/roles/quic/crypto-quic.c‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1009,20 +1009,24 @@ lws_quic_validate_retry_token(struct lws *wsi, const uint8_t *token, size_t toke
10091009

10101010
size_t p = 0;
10111011
orig_dcid->len = pt[p++];
1012-
if (p + orig_dcid->len > ct_len) return -1;
1013-
memcpy(orig_dcid->id, &pt[p], orig_dcid->len);
1012+
if (p + orig_dcid->len > ct_len || p + orig_dcid->len > sizeof(pt)) return -1;
1013+
if (orig_dcid->len > sizeof(orig_dcid->id)) return -1;
1014+
if (orig_dcid->len)
1015+
memcpy(orig_dcid->id, pt + p, orig_dcid->len);
10141016
p += orig_dcid->len;
10151017

1016-
if (p >= ct_len) return -1;
1018+
if (p >= ct_len || p >= sizeof(pt)) return -1;
10171019
retry_scid->len = pt[p++];
1018-
if (p + retry_scid->len > ct_len) return -1;
1019-
memcpy(retry_scid->id, &pt[p], retry_scid->len);
1020+
if (p + retry_scid->len > ct_len || p + retry_scid->len > sizeof(pt)) return -1;
1021+
if (retry_scid->len > sizeof(retry_scid->id)) return -1;
1022+
if (retry_scid->len)
1023+
memcpy(retry_scid->id, pt + p, retry_scid->len);
10201024
p += retry_scid->len;
10211025

1022-
if (p >= ct_len) return -1;
1026+
if (p >= ct_len || p >= sizeof(pt)) return -1;
10231027
if (pt[p++] != ip_len) return -1;
1024-
if (p + ip_len > ct_len) return -1;
1025-
if (memcmp(&pt[p], client_ip, ip_len)) return -1;
1028+
if (p + ip_len > ct_len || p + ip_len > sizeof(pt)) return -1;
1029+
if (ip_len && memcmp(pt + p, client_ip, ip_len)) return -1;
10261030

10271031
return 0;
10281032
}

‎lib/system/async-dns/async-dns-parse.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ lws_adns_parse_label(const uint8_t *pkt, int len, const uint8_t *ls, int budget,
6262
return -1;
6363
/* pointer into message pkt to name to actually use */
6464
n = lws_ser_ru16be(ls) & 0x3fff;
65-
if (n < DHO_SIZEOF || n >= len) {
65+
if (n < DHO_SIZEOF || n >= LWS_ADNS_MAX_PAYLOAD || n >= len) {
6666
lwsl_notice("%s: illegal name pointer\n", __func__);
6767

6868
return -1;
@@ -94,7 +94,7 @@ lws_adns_parse_label(const uint8_t *pkt, int len, const uint8_t *ls, int budget,
9494
return -1;
9595

9696
ll = *ls++;
97-
if (ls + ll + 1 > e) {
97+
if (ll > 63 || ls + ll + 1 > e) {
9898
lwsl_notice("%s: label len invalid, %d vs %d\n", __func__,
9999
lws_ptr_diff((ls + ll + 1), pkt), lws_ptr_diff(e, pkt));
100100

‎lib/system/async-dns/async-dns.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1654,7 +1654,7 @@ lws_async_dns_get_alpn(struct lws_context *context, const char *name, const char
16541654

16551655
/* TargetName: sequence of labels ending in 0 */
16561656
limit = 128;
1657-
while (pos < paylen && rr[pos] && limit--) {
1657+
while (limit-- && pos < paylen && rr[pos]) {
16581658
if (pos + rr[pos] + 1 > paylen)
16591659
return 0;
16601660
pos += rr[pos] + 1;
@@ -1665,7 +1665,7 @@ lws_async_dns_get_alpn(struct lws_context *context, const char *name, const char
16651665

16661666
/* SvcParams */
16671667
limit = 128;
1668-
while (pos + 4 <= paylen && limit--) {
1668+
while (limit-- && pos + 4 <= paylen) {
16691669
uint16_t key = (uint16_t)((rr[pos] << 8) | rr[pos + 1]);
16701670
uint16_t len = (uint16_t)((rr[pos + 2] << 8) | rr[pos + 3]);
16711671
pos += 4;
@@ -1676,7 +1676,7 @@ lws_async_dns_get_alpn(struct lws_context *context, const char *name, const char
16761676
if (key == 1) { /* alpn */
16771677
uint16_t i = 0;
16781678
int limit2 = 128;
1679-
while (i < len && limit2--) {
1679+
while (limit2-- && i < len) {
16801680
uint8_t slen = rr[pos + i];
16811681
if (i + 1 + slen > len)
16821682
break;

‎minimal-examples-lowlevel/api-tests/api-test-qpack/main.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -391,6 +391,12 @@ test_qif_file(const char *filepath)
391391
len = ((uint32_t)header[8] << 24) | ((uint32_t)header[9] << 16) |
392392
((uint32_t)header[10] << 8) | header[11];
393393

394+
if (len > sizeof(buf)) {
395+
lwsl_err("Too big block %u\n", (unsigned int)len);
396+
fails++;
397+
break;
398+
}
399+
394400
s = read(fd, buf, len);
395401
if (s != (ssize_t)len) break;
396402

0 commit comments

Comments
 (0)