litespeedtech/ls-qpack

Decoder miscalculates compression ratio

Opened this issue · 0 comments

In the function header_out_write_value(), the counter qpd_bytes_out is updated after dhi_process_header() is called, instead of before:

        r = dec->qpd_dh_if->dhi_process_header(read_ctx->hbrc_hblock, xhdr);
        if (r == 0)
            dec->qpd_bytes_out += xhdr->name_len + xhdr->val_len;

The problem here is that the user callback is free to modify xhdr in any manner, potentially making name_len and val_len invalid.