Out of bounds access in h2::hpack::table::Table::index_dynamic
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.6k
- Forks
- 382
- Avg merge
- 20h 23m
- Merged PRs (30d)
- 9
Description
On v0.3.7.
I saw this panic in our service. Unfortunately I was not able to capture the input that caused this.
It seems it is related to the soundness of the index there. But I don't understand it enough. So I just log the issue here in case anyone knows anything about it.
Application Specific Information:
Out of bounds access
Thread 0 Crashed:
0 std std::sys_common::backtrace::__rust_end_short_backtrace (backtrace.rs:141)
1 <unknown> rust_begin_unwind (panicking.rs:515)
2 core core::panicking::panic_fmt (panicking.rs:92)
3 core core::option::expect_failed (option.rs:1243)
4 core [inlined] core::option::Option<T>::expect (option.rs:351)
5 alloc [inlined] alloc::collections::vec_deque::VecDeque<T>::index (mod.rs:2724)
6 h2 [inlined] h2::hpack::table::Table::index_dynamic (table.rs:193)
7 h2 [inlined] h2::hpack::table::Table::index (table.rs:157)
8 h2 [inlined] h2::hpack::encoder::Encoder::encode (encoder.rs:77)
9 h2 h2::frame::headers::HeaderBlock::into_encoding (headers.rs:904)
10 h2 h2::frame::headers::Headers::encode (headers.rs:268)
11 h2 [inlined] h2::codec::framed_write::Encoder<T>::buffer (framed_write.rs:264)
12 h2 [inlined] h2::codec::framed_write::FramedWrite<T>::buffer (framed_write.rs:115)
13 h2 h2::codec::Codec<T>::buffer (mod.rs:141)
14 h2 [inlined] h2::proto::streams::prioritize::Prioritize::poll_complete (prioritize.rs:505)
15 h2 [inlined] h2::proto::streams::send::Send::poll_complete (send.rs:297)
16 h2 h2::proto::streams::streams::Inner::poll_complete (streams.rs:850)
17 h2 [inlined] h2::proto::streams::streams::Streams<T>::poll_complete (streams.rs:180)
18 h2 [inlined] h2::proto::connection::Connection<T>::poll (connection.rs:253)
19 h2 h2::client::Connection<T>::poll (client.rs:1279)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/hpack/table.rs at Table::index_dynamic (line 193) and Table::index (line 157), then trace the call from src/hpack/encoder.rs line 77. The report has no reproducing input, so first determine how the dynamic-table index becomes invalid during encoding. Done means the out-of-bounds panic is addressed and the reported path is validated against a reproducing case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100