Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-546

Possible ArrayIndexOutOfBoundsException in HTTP2 HPACK implementation

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Minor
    • 1.2.13.Final, 1.3.0.CR3
    • None
    • None
    • None
    • Hide

      Send HTTP2 HEADER frame with huge index encoded. Stack trace:

      16:00:30,279 ERROR [org.xnio.listener] (default I/O-1) XNIO001007: A channel event listener threw an exception: java.lang.ArrayIndexOutOfBoundsException: 35
      	at io.undertow.protocols.http2.Hpack.decodeInteger(Hpack.java:175)
      	at io.undertow.protocols.http2.HpackDecoder.readHpackString(HpackDecoder.java:204)
      	at io.undertow.protocols.http2.HpackDecoder.decode(HpackDecoder.java:123)
      	at io.undertow.protocols.http2.Http2HeaderBlockParser.handleData(Http2HeaderBlockParser.java:66)
      	at io.undertow.protocols.http2.Http2PushBackParser.parse(Http2PushBackParser.java:58)
      	at io.undertow.protocols.http2.Http2FrameHeaderParser.handle(Http2FrameHeaderParser.java:133)
      	at io.undertow.protocols.http2.Http2Channel.parseFrame(Http2Channel.java:399)
      	at io.undertow.server.protocol.framed.AbstractFramedChannel.receive(AbstractFramedChannel.java:393)
      	at io.undertow.server.protocol.http2.Http2ReceiveListener.handleEvent(Http2ReceiveListener.java:103)
      	at io.undertow.server.protocol.http2.Http2ReceiveListener.handleEvent(Http2ReceiveListener.java:56)
      	at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
      	at io.undertow.server.protocol.framed.AbstractFramedChannel$FrameReadListener.handleEvent(AbstractFramedChannel.java:852)
      	at io.undertow.server.protocol.framed.AbstractFramedChannel$FrameReadListener.handleEvent(AbstractFramedChannel.java:835)
      	at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
      	at org.xnio.conduits.ReadReadyHandler$ChannelListenerHandler.readReady(ReadReadyHandler.java:66)
      	at io.undertow.protocols.ssl.SslConduit$SslReadReadyHandler.readReady(SslConduit.java:1057)
      	at io.undertow.protocols.ssl.SslConduit$1.run(SslConduit.java:225)
      	at org.xnio.nio.WorkerThread.safeRun(WorkerThread.java:560)
      	at org.xnio.nio.WorkerThread.run(WorkerThread.java:462)
      
      Show
      Send HTTP2 HEADER frame with huge index encoded. Stack trace: 16:00:30,279 ERROR [org.xnio.listener] ( default I/O-1) XNIO001007: A channel event listener threw an exception: java.lang.ArrayIndexOutOfBoundsException: 35 at io.undertow.protocols.http2.Hpack.decodeInteger(Hpack.java:175) at io.undertow.protocols.http2.HpackDecoder.readHpackString(HpackDecoder.java:204) at io.undertow.protocols.http2.HpackDecoder.decode(HpackDecoder.java:123) at io.undertow.protocols.http2.Http2HeaderBlockParser.handleData(Http2HeaderBlockParser.java:66) at io.undertow.protocols.http2.Http2PushBackParser.parse(Http2PushBackParser.java:58) at io.undertow.protocols.http2.Http2FrameHeaderParser.handle(Http2FrameHeaderParser.java:133) at io.undertow.protocols.http2.Http2Channel.parseFrame(Http2Channel.java:399) at io.undertow.server.protocol.framed.AbstractFramedChannel.receive(AbstractFramedChannel.java:393) at io.undertow.server.protocol.http2.Http2ReceiveListener.handleEvent(Http2ReceiveListener.java:103) at io.undertow.server.protocol.http2.Http2ReceiveListener.handleEvent(Http2ReceiveListener.java:56) at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92) at io.undertow.server.protocol.framed.AbstractFramedChannel$FrameReadListener.handleEvent(AbstractFramedChannel.java:852) at io.undertow.server.protocol.framed.AbstractFramedChannel$FrameReadListener.handleEvent(AbstractFramedChannel.java:835) at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92) at org.xnio.conduits.ReadReadyHandler$ChannelListenerHandler.readReady(ReadReadyHandler.java:66) at io.undertow.protocols.ssl.SslConduit$SslReadReadyHandler.readReady(SslConduit.java:1057) at io.undertow.protocols.ssl.SslConduit$1.run(SslConduit.java:225) at org.xnio.nio.WorkerThread.safeRun(WorkerThread.java:560) at org.xnio.nio.WorkerThread.run(WorkerThread.java:462)

    Description

      When decoding really huge number via Hpack.decodeInteger() there is possible ArrayIndexOutOfBoundsException caused by unchecked index variable "m" into array on this line .

      There should be some check that "m" is not greater than PREFIX_TABLE.length-1.

      Attachments

        Issue Links

          Activity

            People

              sdouglas1@redhat.com Stuart Douglas
              jstourac@redhat.com Jan Stourac
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: