litespeedtech / litespeedtech/ls-qpack
Decoder miscalculates compression ratio
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 86
- Forks
- 36
- PR merge metrics
- No merged PRs in 30d
Description
In the function `header_out_write_value()`, the counter `qpd_bytes_out` is updated after `dhi_process_header()` is called, [instead of before](https://github.com/litespeedtech/ls-qpack/blob/705020b64181e0f38f871af0bfa2d221726c1156/lsqpack.c#L3265L3267):
```c
r = dec->qpd_dh_if->dhi_process_header(read_ctx->hbrc_hblock, xhdr);
if (r == 0)
dec->qpd_bytes_out += xhdr->name_len + xhdr->val_len;
```
The problem here is that the user callback is free to modify `xhdr` in any manner, potentially making `name_len` and `val_len` invalid.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in lsqpack.c at header_out_write_value(), especially the dhi_process_header() call and qpd_bytes_out update shown in the issue. Review how the user callback can modify xhdr, then verify that compression-ratio accounting remains correct when the callback changes its lengths.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 58/100