Skip to content

Commit c2208b5

Browse files
dtikhonovdtikhonov
authored
Release 4.7.2 (#650)
- [FIX] Only ignore Priority: header after PRIORITY_UPDATE and in client mode. - [FIX] Transport params: reject partial preferred address families. - [IMPROVEMENT] PRIORITY_UPDATE frame handling.
1 parent 7ca0b37 commit c2208b5

14 files changed

Lines changed: 576 additions & 26 deletions

‎CHANGELOG‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
2026-06-05
2+
- 4.7.2
3+
- [FIX] Only ignore Priority: header after PRIORITY_UPDATE and in
4+
client mode.
5+
- [FIX] Transport params: reject partial preferred address families.
6+
- [IMPROVEMENT] PRIORITY_UPDATE frame handling.
7+
18
2026-05-25
29
- 4.7.1
310
- [FIX] Content-length check in QPACK decoder handler.

‎docs/conf.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
# The short X.Y version
2727
version = u'4.7'
2828
# The full version, including alpha/beta/rc tags
29-
release = u'4.7.1'
29+
release = u'4.7.2'
3030

3131

3232
# -- General configuration ---------------------------------------------------

‎include/lsquic.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ extern "C" {
2727

2828
#define LSQUIC_MAJOR_VERSION 4
2929
#define LSQUIC_MINOR_VERSION 7
30-
#define LSQUIC_PATCH_VERSION 1
30+
#define LSQUIC_PATCH_VERSION 2
3131

3232
#define LSQUIC_QUOTE(x) #x
3333
#define LSQUIC_SVAL(v) LSQUIC_QUOTE(v)

‎src/liblsquic/lsquic_full_conn_ietf.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5252,7 +5252,7 @@ new_stream (struct ietf_full_conn *conn, lsquic_stream_id_t stream_id,
52525252
stream->id);
52535253
lsquic_hash_erase(conn->ifc_bpus, el);
52545254
bpu = lsquic_hashelem_getdata(el);
5255-
(void) lsquic_stream_set_http_prio(stream, &bpu->ehp);
5255+
(void) lsquic_stream_set_http_prio_ext(stream, &bpu->ehp, 1);
52565256
free(bpu);
52575257
}
52585258
}
@@ -9391,7 +9391,7 @@ on_priority_update_server (void *ctx, enum hq_frame_type frame_type,
93919391
{ /* Empty PFV means "use defaults" */ }
93929392

93939393
if (stream)
9394-
(void) lsquic_stream_set_http_prio(stream, &ehp);
9394+
(void) lsquic_stream_set_http_prio_ext(stream, &ehp, 1);
93959395
else
93969396
{
93979397
assert(frame_type == HQFT_PRIORITY_UPDATE_STREAM);

‎src/liblsquic/lsquic_hcsi_reader.c‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,18 @@ lsquic_hcsi_reader_feed (struct hcsi_reader *reader, const void *buf,
169169
case HQFT_PRIORITY_UPDATE_PUSH:
170170
case HQFT_PRIORITY_UPDATE_STREAM:
171171
len = reader->hr_frame_length - reader->hr_nread;
172-
if (len <= (uintptr_t) (end - p))
172+
if (len > sizeof(reader->hr_u.prio_state.buf))
173+
{
174+
/* 16 bytes is more than enough for a PRIORITY_UPDATE
175+
* frame, anything larger than that is unreasonable.
176+
*/
177+
LSQ_INFO("skip PRIORITY_UPDATE frame that's too "
178+
"long (%"PRIu64" bytes)", len);
179+
reader->hr_frame_length = len;
180+
reader->hr_state = HR_SKIPPING;
181+
goto continue_reading;
182+
}
183+
else if (len <= (uintptr_t) (end - p))
173184
{
174185
reader->hr_cb->on_priority_update(reader->hr_ctx,
175186
reader->hr_frame_type, reader->hr_u.vint_state.val,
@@ -183,17 +194,6 @@ lsquic_hcsi_reader_feed (struct hcsi_reader *reader, const void *buf,
183194
reader->hr_state = HR_READ_PRIORITY_UPDATE;
184195
goto continue_reading;
185196
}
186-
else
187-
{
188-
p += len;
189-
/* 16 bytes is more than enough for a PRIORITY_UPDATE
190-
* frame, anything larger than that is unreasonable.
191-
*/
192-
if (reader->hr_frame_length
193-
> sizeof(reader->hr_u.prio_state.buf))
194-
LSQ_INFO("skip PRIORITY_UPDATE frame that's too "
195-
"long (%"PRIu64" bytes)", len);
196-
}
197197
break;
198198
default:
199199
assert(0);

‎src/liblsquic/lsquic_qdec_hdl.c‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -584,7 +584,13 @@ qdh_process_header (void *stream_p, struct lsxpack_header *xhdr)
584584
if (cl.has > 0)
585585
(void) lsquic_stream_verify_len(stream, cl.value);
586586
}
587-
else if ((stream->sm_bflags & (SMBF_HTTP_PRIO|SMBF_HPRIO_SET))
587+
else if ((qdh->qdh_flags & QDH_SERVER) &&
588+
/* If PRIORITY_UPDATE has been used (SMBF_HPRIO_SET), then the
589+
* Priority header should be ignored: this is because former is
590+
* likely to have originated later and thus has more up-to-date
591+
* priority information.
592+
*/
593+
(stream->sm_bflags & (SMBF_HTTP_PRIO|SMBF_HPRIO_SET))
588594
== SMBF_HTTP_PRIO
589595
&& is_priority(xhdr))
590596
{
@@ -639,14 +645,18 @@ qdh_header_read_results (struct qpack_dec_hdl *qdh,
639645
{
640646
if (1) //!lsquic_stream_header_is_trailer(stream))
641647
{
642-
if (stream->sm_hblock_ctx->ctx.ppc_flags
648+
if ((stream->sm_hblock_ctx->ctx.ppc_flags
643649
& (PPC_INC_SET|PPC_URG_SET))
650+
/* If PRIORITY_UPDATE came in while we were parsing
651+
* headers, it should win, not Priority header.
652+
*/
653+
&& !(stream->sm_bflags & SMBF_HPRIO_SET))
644654
{
645655
assert(stream->sm_bflags & SMBF_HTTP_PRIO);
646656
LSQ_DEBUG("Apply Priority from headers to stream %"PRIu64,
647657
stream->id);
648-
(void) lsquic_stream_set_http_prio(stream,
649-
&stream->sm_hblock_ctx->ctx.ehp);
658+
(void) lsquic_stream_set_http_prio_ext(stream,
659+
&stream->sm_hblock_ctx->ctx.ehp, 0);
650660
}
651661
hset = stream->sm_hblock_ctx->ctx.hset;
652662
uh = (void *) stream->sm_hblock_ctx;

‎src/liblsquic/lsquic_stream.c‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5245,8 +5245,8 @@ lsquic_stream_get_http_prio (struct lsquic_stream *stream,
52455245

52465246

52475247
int
5248-
lsquic_stream_set_http_prio (struct lsquic_stream *stream,
5249-
const struct lsquic_ext_http_prio *ehp)
5248+
lsquic_stream_set_http_prio_ext (struct lsquic_stream *stream,
5249+
const struct lsquic_ext_http_prio *ehp, int is_priority_update)
52505250
{
52515251
if (stream->sm_bflags & SMBF_HTTP_PRIO)
52525252
{
@@ -5260,7 +5260,8 @@ lsquic_stream_set_http_prio (struct lsquic_stream *stream,
52605260
stream->sm_bflags |= SMBF_INCREMENTAL;
52615261
else
52625262
stream->sm_bflags &= ~SMBF_INCREMENTAL;
5263-
stream->sm_bflags |= SMBF_HPRIO_SET;
5263+
if (is_priority_update)
5264+
stream->sm_bflags |= SMBF_HPRIO_SET;
52645265
LSQ_DEBUG("set urgency to %hhu, incremental to %hhd", ehp->urgency,
52655266
ehp->incremental);
52665267
if (!(stream->sm_bflags & SMBF_SERVER))
@@ -5273,6 +5274,14 @@ lsquic_stream_set_http_prio (struct lsquic_stream *stream,
52735274
}
52745275

52755276

5277+
int
5278+
lsquic_stream_set_http_prio (struct lsquic_stream *stream,
5279+
const struct lsquic_ext_http_prio *ehp)
5280+
{
5281+
return lsquic_stream_set_http_prio_ext(stream, ehp, 0);
5282+
}
5283+
5284+
52765285
int
52775286
lsquic_stream_has_unacked_data (struct lsquic_stream *stream)
52785287
{

‎src/liblsquic/lsquic_stream.h‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ enum stream_b_flags
191191
SMBF_VERIFY_CL = 1 << 9, /* Verify content-length (stored in sm_cont_len) */
192192
SMBF_HTTP_PRIO = 1 <<10, /* Extensible HTTP Priorities are used */
193193
SMBF_INCREMENTAL = 1 <<11, /* Value of the "incremental" HTTP Priority parameter */
194-
SMBF_HPRIO_SET = 1 <<12, /* Extensible HTTP Priorities have been set once */
194+
SMBF_HPRIO_SET = 1 <<12, /* PRIORITY_UPDATE has been used to set ext. priority */
195195
SMBF_DELAY_ONCLOSE= 1 <<13, /* Delay calling on_close() until peer ACKs everything */
196196
#if LSQUIC_WEBTRANSPORT_SERVER_SUPPORT
197197
SMBF_WEBTRANSPORT_SESSION_STREAM = 1 <<14, /* WEBTRANSPORT session stream */
@@ -651,4 +651,8 @@ lsquic_stream_set_pwritev_params (unsigned iovecs, unsigned frames);
651651
void
652652
lsquic_stream_drop_hset_ref (struct lsquic_stream *);
653653

654+
int
655+
lsquic_stream_set_http_prio_ext (struct lsquic_stream *,
656+
const struct lsquic_ext_http_prio *, int is_priority_update);
657+
654658
#endif

‎src/liblsquic/lsquic_trans_params.c‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -669,6 +669,22 @@ lsquic_tp_decode (const unsigned char *const buf, size_t bufsz,
669669
q += sizeof(params->tp_preferred_address.srst);
670670
if (q != p + len)
671671
return -1;
672+
if ((0 != params->tp_preferred_address.ipv4_port)
673+
!= !lsquic_is_zero(params->tp_preferred_address.ipv4_addr,
674+
sizeof(params->tp_preferred_address.ipv4_addr)))
675+
{
676+
LSQ_DEBUG("preferred server IPv4 address is only partially "
677+
"specified");
678+
return -1;
679+
}
680+
if ((0 != params->tp_preferred_address.ipv6_port)
681+
!= !lsquic_is_zero(params->tp_preferred_address.ipv6_addr,
682+
sizeof(params->tp_preferred_address.ipv6_addr)))
683+
{
684+
LSQ_DEBUG("preferred server IPv6 address is only partially "
685+
"specified");
686+
return -1;
687+
}
672688
break;
673689
case TPI_VERSION_INFORMATION:
674690
if (len & 0x3)
@@ -1237,6 +1253,22 @@ lsquic_tp_decode_27 (const unsigned char *const buf, size_t bufsz,
12371253
q += sizeof(params->tp_preferred_address.srst);
12381254
if (q != p + len)
12391255
return -1;
1256+
if ((0 != params->tp_preferred_address.ipv4_port)
1257+
!= !lsquic_is_zero(params->tp_preferred_address.ipv4_addr,
1258+
sizeof(params->tp_preferred_address.ipv4_addr)))
1259+
{
1260+
LSQ_DEBUG("preferred server IPv4 address is only partially "
1261+
"specified");
1262+
return -1;
1263+
}
1264+
if ((0 != params->tp_preferred_address.ipv6_port)
1265+
!= !lsquic_is_zero(params->tp_preferred_address.ipv6_addr,
1266+
sizeof(params->tp_preferred_address.ipv6_addr)))
1267+
{
1268+
LSQ_DEBUG("preferred server IPv6 address is only partially "
1269+
"specified");
1270+
return -1;
1271+
}
12401272
break;
12411273
default:
12421274
/* Do nothing: skip this transport parameter */

‎tests/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ SET(TESTS
4545
goaway_gquic_be
4646
hkdf
4747
hpi
48+
http_prio_header
4849
http1x_if
4950
lsquic_hash
5051
mini_conn_delay

0 commit comments

Comments
 (0)