romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-06-15 03:45:38 +03:00
Code Issues Projects Releases Packages Wiki Activity

quic: count zero length packets against max

Browse source 
With a flood of zero lenght UDP packets to curl, the receive loop might
run longer than intended to. Count such packets against the max to
terminate the loop as intended.

URL: https://hackerone.com/reports/3783438
Reported-by: vectorqueue on hackerone
Closes #21869
This commit is contained in:
Stefan Eissing 2026-06-05 08:34:46 +02:00 • committed by Daniel Stenberg
parent c32427d0c1
commit 56eca2afb4
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/vquic/vquic.c
View file

@ -508,8 +508,10 @@ static CURLcode recvmmsg_packets(struct Curl_cfilter *cf,
VERBOSE(++calls);
for(i = 0; i < mcount; ++i) {
/* A zero-length UDP packet is no QUIC packet. Ignore. */
if(!mmsg[i].msg_len)
if(!mmsg[i].msg_len) {
++pkts;
continue;
}
total_nread += mmsg[i].msg_len;
gso_size = vquic_msghdr_get_udp_gro(&mmsg[i].msg_hdr);
@ -593,8 +595,10 @@ static CURLcode recvmsg_packets(struct Curl_cfilter *cf,
++calls;
/* A 0-length UDP packet is no QUIC packet */
if(!nread)
if(!nread) {
++pkts;
continue;
}
gso_size = vquic_msghdr_get_udp_gro(&msg);
if(gso_size == 0)