[10.2][http3] QPACK blocked-decode DecodeRequest holds a raw pointer into a reused frame (use-after-free)

Branch: 10.2.x (10.2.1, commit 31f1f2f3b) · Severity: high · category: use-after-free
Location: include/proxy/http3/QPACK.h (DecodeRequest), used from src/proxy/http3/QPACK.cc:295 / :1039

What's wrong

When a QPACK-encoded HEADERS block references dynamic-table entries not yet received, QPACK::decode() stashes a DecodeRequest holding the raw header_block pointer and length and returns 1 (blocked). That pointer comes from Http3HeadersFrame::header_block(), an ats_malloc'd buffer owned by the per-transaction reusable frame from Http3FrameFactory::fast_create. A later HEADERS frame on the same stream (trailers) drives frame->reset() → ~Http3HeadersFrame() → ats_free(_header_block), freeing exactly the buffer the pending DecodeRequest still points at. When the encoder stream later unblocks the request, _resume_decode() calls _decode(..., r->header_block(), r->header_block_len(), ...) on the freed buffer — a use-after-free of attacker-controlled data on the HTTP/3 request path.

Fix

Make DecodeRequest own a copy of the header-block bytes (std::vector<uint8_t>) instead of storing a raw pointer into the reusable frame. PR attached.

Notes

This is the 10.2 counterpart of the same bug fixed for master on branch claude/codebase-audit-review-9nw7vz (#18), where it was adversarially verified end-to-end. The 10.2.1 DecodeRequest still stores a raw const uint8_t *, so the bug is present here too.

Testing

⚠️ HTTP/3 code — requires a quiche-enabled build (ci-fedora-quiche); not compile-tested locally (quiche unavailable in the dev environment). Please run it through the quiche CI job. clang-format clean.

From an automated multi-lens audit of the 10.2.x branch. Full report on branch claude/codebase-audit-review-9nw7vz (CODEBASE_AUDIT_10.2.md).

Start in include/proxy/http3/QPACK.h and trace DecodeRequest through src/proxy/http3/QPACK.cc at lines 295 and 1039, including _resume_decode(). Confirm how Http3HeadersFrame::header_block() is reused and freed. Done means the blocked decode no longer retains a raw pointer to that frame buffer; run the quiche-enabled ci-fedora-quiche job.