maskit commented on code in PR #13117:
URL: https://github.com/apache/trafficserver/pull/13117#discussion_r3134761985
##########
src/iocore/net/TLSCertCompression_zstd.cc:
##########
@@ -60,6 +61,12 @@ compression_func_zstd(SSL * /* ssl */, CBB *out, const
uint8_t *in, size_t in_le
int
decompression_func_zstd(SSL * /* ssl */, CRYPTO_BUFFER **out, size_t
uncompressed_len, const uint8_t *in, size_t in_len)
{
+ if (uncompressed_len > MAX_CERT_UNCOMPRESSED_LEN) {
+ *out = nullptr;
+ Metrics::Counter::increment(ssl_rsb.cert_decompress_zstd_failure);
+ return 0;
+ }
Review Comment:
Not testable
##########
src/iocore/net/TLSCertCompression_brotli.cc:
##########
@@ -55,6 +56,12 @@ compression_func_brotli(SSL * /* ssl */, CBB *out, const
uint8_t *in, size_t in_
int
decompression_func_brotli(SSL * /* ssl */, CRYPTO_BUFFER **out, size_t
uncompressed_len, const uint8_t *in, size_t in_len)
{
+ if (uncompressed_len > MAX_CERT_UNCOMPRESSED_LEN) {
+ *out = nullptr;
+ Metrics::Counter::increment(ssl_rsb.cert_decompress_brotli_failure);
+ return 0;
+ }
Review Comment:
Not testable
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
