Skip to content

Commit

Permalink
Fixed handling of zero-length value by tfw_hpack_hdr_inplace()
Browse files Browse the repository at this point in the history
Closes the issue tempesta-tech#1549 "Kernel panic for cached HTTP/2 response with
empty header value"
  • Loading branch information
byko3y authored Feb 8, 2022
1 parent 66704db commit 25a420c
Showing 1 changed file with 13 additions and 10 deletions.
23 changes: 13 additions & 10 deletions fw/hpack.c
Original file line number Diff line number Diff line change
Expand Up @@ -2445,9 +2445,6 @@ tfw_hpack_write(const TfwStr *h_field, char *out_buf)

T_DBG3("%s: enter, h_field->len=%lu,\n", __func__, h_field->len);

if (WARN_ON_ONCE(TFW_STR_EMPTY(h_field)))
return out_buf;

TFW_STR_FOR_EACH_CHUNK(c, h_field, end) {
if (!c->len)
continue;
Expand Down Expand Up @@ -3031,6 +3028,7 @@ tfw_hpack_add_node(TfwHPackETbl *__restrict tbl, TfwStr *__restrict hdr,

hdr_len = tfw_http_hdr_split(hdr, &s_nm, &s_val,
op == TFW_H2_TRANS_INPLACE);
WARN_ON_ONCE(TFW_STR_EMPTY(&s_nm));

WARN_ON_ONCE(cur_size > window || window > HPACK_ENC_TABLE_MAX_SIZE);
if ((node_size = hdr_len + HPACK_ENTRY_OVERHEAD) > window) {
Expand Down Expand Up @@ -3126,7 +3124,8 @@ tfw_hpack_add_node(TfwHPackETbl *__restrict tbl, TfwStr *__restrict hdr,
it.last->rindex = ++tbl->idx_acc;

ptr = tfw_hpack_write(&s_nm, it.last->hdr);
tfw_hpack_write(&s_val, ptr);
if (!TFW_STR_EMPTY(&s_val))
tfw_hpack_write(&s_val, ptr);

tfw_hpack_rbuf_commit(tbl, hdr, del_list, place, &it);

Expand Down Expand Up @@ -3656,13 +3655,16 @@ tfw_hpack_hdr_inplace(TfwHttpResp *__restrict resp, TfwStr *__restrict hdr,
if (unlikely(r))
return r;

bnd = __TFW_STR_CH(&s_val, 0)->data;
if (!TFW_STR_EMPTY(&s_val))
bnd = __TFW_STR_CH(&s_val, 0)->data;
else
bnd = mit->bnd;

r = tfw_h2_msg_rewrite_data_lc(mit, &s_name, bnd);
if (unlikely(r))
return r;
} else {
bnd = indexed
bnd = indexed || TFW_STR_EMPTY(&s_val)
? mit->bnd
: __TFW_STR_CH(&s_val, 0)->data;

Expand All @@ -3681,10 +3683,11 @@ tfw_hpack_hdr_inplace(TfwHttpResp *__restrict resp, TfwStr *__restrict hdr,
r = tfw_h2_msg_rewrite_data(mit, &s_vlen, bnd);
if (unlikely(r))
return r;

r = tfw_h2_msg_rewrite_data(mit, &s_val, mit->bnd);
if (unlikely(r))
return r;
if (!TFW_STR_EMPTY(&s_val)) {
r = tfw_h2_msg_rewrite_data(mit, &s_val, mit->bnd);
if (unlikely(r))
return r;
}

return 0;
}
Expand Down

0 comments on commit 25a420c

Please sign in to comment.