From: Matus Fabian <matfabia@cisco.com>
Date: Thu, 14 Aug 2025 19:27:07 +0000 (-0400)
Subject: http: h2 fix handling of incomplete frame headers
X-Git-Tag: v26.02-rc0~94
X-Git-Url: https://gerrit.fd.io/r/gitweb?a=commitdiff_plain;h=refs%2Fchanges%2F52%2F43552%2F1;p=vpp.git

http: h2 fix handling of incomplete frame headers

Type: fix

Change-Id: I47155fd7d453b0e9bdcf39f5bc14139323a9a42e
Signed-off-by: Matus Fabian <matfabia@cisco.com>
---

diff --git a/src/plugins/http/http2/http2.c b/src/plugins/http/http2/http2.c
index cde1a33c540..834d79ec3a9 100644
--- a/src/plugins/http/http2/http2.c
+++ b/src/plugins/http/http2/http2.c
@@ -2880,13 +2880,6 @@ http2_transport_rx_callback (http_conn_t *hc)
   if (PREDICT_FALSE (to_deq < HTTP2_FRAME_HEADER_SIZE))
     {
       HTTP_DBG (1, "to_deq %u is less than frame header size", to_deq);
-#if HTTP_DEBUG
-      u8 *tmp = 0;
-      vec_validate (tmp, to_deq - 1);
-      http_io_ts_read (hc, tmp, to_deq, 0);
-      clib_warning ("%U", format_hex_bytes, tmp, to_deq);
-#endif
-      http2_connection_error (hc, HTTP2_ERROR_PROTOCOL_ERROR, 0);
       return;
     }
 
@@ -2920,20 +2913,6 @@ http2_transport_rx_callback (http_conn_t *hc)
       http_io_ts_drain (hc, HTTP2_FRAME_HEADER_SIZE);
       to_deq -= fh.length;
 
-      /* to prevent data leakage */
-      if (to_deq && to_deq < HTTP2_FRAME_HEADER_SIZE)
-	{
-	  HTTP_DBG (1, "to_deq %u is less than frame header size", to_deq);
-#if HTTP_DEBUG
-	  u8 *tmp = 0;
-	  vec_validate (tmp, to_deq - 1);
-	  http_io_ts_read (hc, tmp, to_deq, 0);
-	  clib_warning ("%U", format_hex_bytes, tmp, to_deq);
-#endif
-	  http2_connection_error (hc, HTTP2_ERROR_PROTOCOL_ERROR, 0);
-	  return;
-	}
-
       HTTP_DBG (1, "frame type 0x%02x len %u", fh.type, fh.length);
 
       if ((h2c->flags & HTTP2_CONN_F_EXPECT_CONTINUATION) &&
@@ -2973,6 +2952,14 @@ http2_transport_rx_callback (http_conn_t *hc)
 	  rv = http2_handle_goaway_frame (hc, &fh);
 	  break;
 	case HTTP2_FRAME_TYPE_PING:
+	  /* to prevent information leakage, PING frames can be sent from any
+	   * endpoint and is expected to be sent with higher priority */
+	  if (to_deq && to_deq < HTTP2_FRAME_HEADER_SIZE)
+	    {
+	      HTTP_DBG (1, "to_deq %u is less than frame header size", to_deq);
+	      http2_connection_error (hc, HTTP2_ERROR_PROTOCOL_ERROR, 0);
+	      return;
+	    }
 	  rv = http2_handle_ping_frame (hc, &fh);
 	  break;
 	case HTTP2_FRAME_TYPE_CONTINUATION: