reject stream frames that overflow the offset

fixes #452
This commit is contained in:
Marten Seemann 2017-02-27 15:45:32 +07:00
parent 20b2069d78
commit 745d7b7e9f
No known key found for this signature in database
GPG key ID: 3603F40B121FCDEA
2 changed files with 18 additions and 1 deletions

View file

@ -79,7 +79,11 @@ func ParseStreamFrame(r *bytes.Reader) (*StreamFrame, error) {
}
}
if !frame.FinBit && len(frame.Data) == 0 {
if frame.Offset+frame.DataLen() < frame.Offset {
return nil, qerr.Error(qerr.InvalidStreamData, "data overflows maximum offset")
}
if !frame.FinBit && frame.DataLen() == 0 {
return nil, qerr.EmptyStreamFrameNoFin
}