Merge commit from fork

A malicious or compromised HTTP/2 server could exhaust client memory by
sending a HEADERS frame without END_HEADERS followed by an unbounded chain
of CONTINUATION frames. Each fragment was appended to
`conn.headers_being_processed` with no cap on size or count, and the block is
only decoded once END_HEADERS arrives — which a hostile server simply never
sends. A single connection could drive the client to OOM (~1 GiB from ~64k
16 KiB frames in the reported PoC).

The client now bounds the accumulated header block by the locally advertised
SETTINGS_MAX_HEADER_LIST_SIZE, which defaults to 256 KB (previously
:infinity, i.e. unbounded). The limit is checked against the compressed
accumulator as each fragment is parked, before it grows, and the connection
is torn down with a PROTOCOL_ERROR GOAWAY once exceeded. The default is also
advertised to the server so well-behaved peers never send oversized blocks;
the receive-side check backstops misbehaving ones. Because the compressed
accumulator is never larger than the header list it decodes to, the limit
never rejects a header block that fits within the advertised size.

The bound is tracked with a running byte count carried in
`headers_being_processed`, so enforcement is O(1) per frame rather than
rescanning the accumulator (which would be O(n^2) under a flood).

Author: ericmj

lib/mint/http2.ex

@@ -156,6 +156,12 @@ defmodule Mint.HTTP2 do
   @default_max_frame_size 16_384
   @valid_max_frame_size_range @default_max_frame_size..16_777_215
 
+  # Default cap on the size of an inbound header block. Advertised to the
+  # server as SETTINGS_MAX_HEADER_LIST_SIZE and enforced while accumulating
+  # HEADERS/CONTINUATION fragments, so that a server cannot exhaust client
+  # memory by streaming an unbounded chain of CONTINUATION frames.
+  @default_max_header_list_size 256 * 1024
+
   @valid_client_settings [
     :max_concurrent_streams,
     :initial_window_size,
@@ -235,7 +241,7 @@ defmodule Mint.HTTP2 do
     client_settings: %{
       max_concurrent_streams: 100,
       initial_window_size: @default_stream_window_size,
-      max_header_list_size: :infinity,
+      max_header_list_size: @default_max_header_list_size,
       max_frame_size: @default_max_frame_size,
       enable_push: true
     },
@@ -297,7 +303,12 @@ defmodule Mint.HTTP2 do
     * `:max_frame_size` - corresponds to `SETTINGS_MAX_FRAME_SIZE`. Tells what is the
       maximum size of an HTTP/2 frame for the peer that sends this setting.
 
-    * `:max_header_list_size` - corresponds to `SETTINGS_MAX_HEADER_LIST_SIZE`.
+    * `:max_header_list_size` - corresponds to `SETTINGS_MAX_HEADER_LIST_SIZE`. For the
+      client, this also bounds the size of an inbound header block (a HEADERS frame plus
+      its trailing CONTINUATION frames): the connection is closed with a connection error
+      if a server streams a header block larger than this value, which prevents a server
+      from exhausting client memory with an unbounded chain of CONTINUATION frames.
+      Defaults to `256 KB` for the client.
 
     * `:enable_connect_protocol` - corresponds to `SETTINGS_ENABLE_CONNECT_PROTOCOL`.
       Sets whether the client may invoke the extended connect protocol which is used to
@@ -1140,7 +1151,9 @@ defmodule Mint.HTTP2 do
     client_settings_params = Keyword.get(opts, :client_settings, [])
 
     client_settings_params =
-      Keyword.put_new(client_settings_params, :initial_window_size, @default_stream_window_size)
+      client_settings_params
+      |> Keyword.put_new(:initial_window_size, @default_stream_window_size)
+      |> Keyword.put_new(:max_header_list_size, @default_max_header_list_size)
 
     validate_client_settings!(client_settings_params)
     # If the port is the default for the scheme, don't add it to the :authority pseudo-header
@@ -1728,7 +1741,7 @@ defmodule Mint.HTTP2 do
       {nil, _frame} ->
         :ok
 
-      {{stream_id, _, _}, continuation(stream_id: stream_id)} ->
+      {{stream_id, _, _, _}, continuation(stream_id: stream_id)} ->
         :ok
 
       _other ->
@@ -1906,7 +1919,7 @@ defmodule Mint.HTTP2 do
       decode_hbf_and_add_responses(conn, responses, hbf, stream, end_stream?)
     else
       callback = &decode_hbf_and_add_responses(&1, &2, &3, &4, end_stream?)
-      conn = put_in(conn.headers_being_processed, {stream_id, hbf, callback})
+      conn = start_headers_being_processed(conn, stream_id, hbf, callback)
       {conn, responses}
     end
   end
@@ -2237,7 +2250,7 @@ defmodule Mint.HTTP2 do
       )
     else
       callback = &decode_push_promise_headers_and_add_response(&1, &2, &3, &4, promised_stream_id)
-      conn = put_in(conn.headers_being_processed, {stream_id, hbf, callback})
+      conn = start_headers_being_processed(conn, stream_id, hbf, callback)
       {conn, responses}
     end
   end
@@ -2392,18 +2405,53 @@ defmodule Mint.HTTP2 do
       assert_stream_in_state(conn, stream, [:open, :half_closed_local, :reserved_remote])
     end
 
-    {^stream_id, hbf_acc, callback} = conn.headers_being_processed
+    {^stream_id, hbf_acc, callback, acc_size} = conn.headers_being_processed
 
     if flag_set?(flags, :continuation, :end_headers) do
       hbf = IO.iodata_to_binary([hbf_acc, hbf_chunk])
       conn = put_in(conn.headers_being_processed, nil)
       callback.(conn, responses, hbf, stream)
     else
-      conn = put_in(conn.headers_being_processed, {stream_id, [hbf_acc, hbf_chunk], callback})
+      new_size = acc_size + byte_size(hbf_chunk)
+      conn = assert_header_block_within_max_size(conn, new_size)
+
+      conn =
+        put_in(
+          conn.headers_being_processed,
+          {stream_id, [hbf_acc, hbf_chunk], callback, new_size}
+        )
+
       {conn, responses}
     end
   end
 
+  defp start_headers_being_processed(conn, stream_id, hbf, callback) do
+    hbf_size = byte_size(hbf)
+    conn = assert_header_block_within_max_size(conn, hbf_size)
+    put_in(conn.headers_being_processed, {stream_id, hbf, callback, hbf_size})
+  end
+
+  # The header block accumulated from a HEADERS frame and its trailing
+  # CONTINUATION frames is buffered (in compressed form) until END_HEADERS
+  # arrives. A server can withhold END_HEADERS and stream CONTINUATION frames
+  # indefinitely, so the buffered size is bounded by the locally advertised
+  # SETTINGS_MAX_HEADER_LIST_SIZE. The compressed accumulator is never larger
+  # than the uncompressed header list it decodes to, so this never rejects a
+  # header block that fits within the advertised limit.
+  defp assert_header_block_within_max_size(conn, size) do
+    case conn.client_settings.max_header_list_size do
+      :infinity ->
+        conn
+
+      max_size when size > max_size ->
+        debug_data = "header block exceeds SETTINGS_MAX_HEADER_LIST_SIZE of #{max_size} bytes"
+        send_connection_error!(conn, :protocol_error, debug_data)
+
+      _max_size ->
+        conn
+    end
+  end
+
   ## General helpers
 
   defp send_connection_error!(conn, error_code, debug_data) do

test/mint/http2/conn_test.exs

@@ -963,6 +963,73 @@ defmodule Mint.HTTP2Test do
       end)
     end
 
+    @tag connect_options: [client_settings: [max_header_list_size: 1_000]]
+    test "a flood of CONTINUATION frames past max_header_list_size is a connection error",
+         %{conn: conn} do
+      {conn, _ref} = open_request(conn)
+
+      assert_recv_frames [headers(stream_id: stream_id)]
+
+      # Each CONTINUATION is individually under the limit, but together they
+      # accumulate past the advertised SETTINGS_MAX_HEADER_LIST_SIZE. The client
+      # must refuse to buffer the header block without bound rather than growing
+      # `headers_being_processed` until it runs out of memory.
+      chunk = :binary.copy(<<0>>, 400)
+
+      assert {:error, %HTTP2{} = conn, error, []} =
+               stream_frames(conn, [
+                 headers(stream_id: stream_id, hbf: "", flags: set_flags(:headers, [])),
+                 continuation(
+                   stream_id: stream_id,
+                   hbf: chunk,
+                   flags: set_flags(:continuation, [])
+                 ),
+                 continuation(
+                   stream_id: stream_id,
+                   hbf: chunk,
+                   flags: set_flags(:continuation, [])
+                 ),
+                 continuation(
+                   stream_id: stream_id,
+                   hbf: chunk,
+                   flags: set_flags(:continuation, [])
+                 )
+               ])
+
+      assert_http2_error error, {:protocol_error, debug_data}
+      assert debug_data =~ "SETTINGS_MAX_HEADER_LIST_SIZE"
+
+      assert_recv_frames [goaway(error_code: :protocol_error)]
+
+      refute HTTP2.open?(conn)
+    end
+
+    @tag connect_options: [client_settings: [max_header_list_size: 1_000]]
+    test "a single oversized HEADERS fragment past max_header_list_size is a connection error",
+         %{conn: conn} do
+      {conn, _ref} = open_request(conn)
+
+      assert_recv_frames [headers(stream_id: stream_id)]
+
+      oversized_hbf = :binary.copy(<<0>>, 2_000)
+
+      assert {:error, %HTTP2{} = conn, error, []} =
+               stream_frames(conn, [
+                 headers(stream_id: stream_id, hbf: oversized_hbf, flags: set_flags(:headers, []))
+               ])
+
+      assert_http2_error error, {:protocol_error, debug_data}
+      assert debug_data =~ "SETTINGS_MAX_HEADER_LIST_SIZE"
+
+      assert_recv_frames [goaway(error_code: :protocol_error)]
+
+      refute HTTP2.open?(conn)
+    end
+
+    test "client advertises a default SETTINGS_MAX_HEADER_LIST_SIZE", %{conn: conn} do
+      assert HTTP2.get_client_setting(conn, :max_header_list_size) == 256 * 1024
+    end
+
     test ":authority pseudo-header includes port", %{conn: conn} do
       {conn, _ref} = open_request(conn)