Fix: infinite loop in parse_header_data() when HTTP/3 header length e…

…xceeds 65535 (#69) Co-authored-by: plumplumli <[email protected]>
litespeedtech · Dec 16, 2024 · f75312d · f75312d
1 parent 778b53d
commit f75312d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lsqpack.c b/lsqpack.c
@@ -3318,7 +3318,7 @@ header_out_grow_buf (struct lsqpack_dec *dec,
         size = 2;
     need = read_ctx->hbrc_out.xhdr->val_len + size / 2;
     if (need > LSXPACK_MAX_STRLEN)
-        need = LSXPACK_MAX_STRLEN;
+        return -1;
     read_ctx->hbrc_out.xhdr = dec->qpd_dh_if->dhi_prepare_decode(
                         read_ctx->hbrc_hblock, read_ctx->hbrc_out.xhdr, need);
     if (!read_ctx->hbrc_out.xhdr)