Release 2.8.5

- [BUGFIX] Fix unintended sign extension when removing header protection.
litespeedtech · Jan 6, 2020 · 72bbf1f · 72bbf1f
1 parent 747be41
commit 72bbf1f
Show file tree

Hide file tree

Showing 5 changed files with 12 additions and 11 deletions.
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,5 +1,5 @@
 2020-01-06
-    - 2.8.4
+    - 2.8.5
     - [HTTP3] Verify number of bytes in incoming DATA frames against
       content-length.
     - [HTTP3] Stop issuing streams credits if peer stops opening QPACK
@@ -8,6 +8,7 @@
       Considerations in the QPACK draft.
     - [BUGFIX] Mini conn: don't shorten max packet size for Q050 and later.
     - [BUGFIX] Init IETF connection flow controller using correct setting.
+    - [BUGFIX] Fix unintended sign extension when removing header protection.
     - Code cleanup and minor fixes.
 
 2019-12-30

diff --git a/include/lsquic.h b/include/lsquic.h
@@ -25,7 +25,7 @@ extern "C" {
 
 #define LSQUIC_MAJOR_VERSION 2
 #define LSQUIC_MINOR_VERSION 8
-#define LSQUIC_PATCH_VERSION 4
+#define LSQUIC_PATCH_VERSION 5
 
 /**
  * Engine flags:

diff --git a/src/liblsquic/lsquic_enc_sess_ietf.c b/src/liblsquic/lsquic_enc_sess_ietf.c
@@ -403,17 +403,17 @@ strip_hp (struct enc_sess_iquic *enc_sess,
         /* fall-through */
     case 3:
         dst[packno_off + 2] ^= mask[3];
-        packno |= dst[packno_off + 2] << shift;
+        packno |= (unsigned) dst[packno_off + 2] << shift;
         shift += 8;
         /* fall-through */
     case 2:
         dst[packno_off + 1] ^= mask[2];
-        packno |= dst[packno_off + 1] << shift;
+        packno |= (unsigned) dst[packno_off + 1] << shift;
         shift += 8;
         /* fall-through */
     default:
         dst[packno_off + 0] ^= mask[1];
-        packno |= dst[packno_off + 0] << shift;
+        packno |= (unsigned) dst[packno_off + 0] << shift;
         shift += 8;
     }
     pns = lsquic_enclev2pns[hp->hp_enc_level];

diff --git a/src/liblsquic/lsquic_handshake.c b/src/liblsquic/lsquic_handshake.c
@@ -4095,17 +4095,17 @@ gquic2_strip_hp (struct lsquic_enc_session *enc_session,
         /* fall-through */
     case 3:
         dst[packno_off + 2] ^= mask[3];
-        packno |= dst[packno_off + 2] << shift;
+        packno |= (unsigned) dst[packno_off + 2] << shift;
         shift += 8;
         /* fall-through */
     case 2:
         dst[packno_off + 1] ^= mask[2];
-        packno |= dst[packno_off + 1] << shift;
+        packno |= (unsigned) dst[packno_off + 1] << shift;
         shift += 8;
         /* fall-through */
     default:
         dst[packno_off + 0] ^= mask[1];
-        packno |= dst[packno_off + 0] << shift;
+        packno |= (unsigned) dst[packno_off + 0] << shift;
         shift += 8;
     }
     return decode_packno(enc_session->es_max_packno, packno, shift);

diff --git a/src/liblsquic/lsquic_pr_queue.c b/src/liblsquic/lsquic_pr_queue.c
@@ -311,15 +311,15 @@ lsquic_prq_new_req (struct pr_queue *prq, enum packet_req_type type,
 
     req->pr_type     = type;
     req->pr_dcid     = *dcid;
-    if (lsquic_hash_find(prq->prq_reqs_hash, req, sizeof(req)))
+    if (lsquic_hash_find(prq->prq_reqs_hash, req, sizeof(*req)))
     {
         LSQ_DEBUG("request for this DCID and type already exists");
         put_req(prq, req);
         return -1;
     }
 
     req->pr_hash_el.qhe_flags = 0;
-    if (!lsquic_hash_insert(prq->prq_reqs_hash, req, sizeof(req),
+    if (!lsquic_hash_insert(prq->prq_reqs_hash, req, sizeof(*req),
                                                     req, &req->pr_hash_el))
     {
         LSQ_DEBUG("could not insert req into hash");
@@ -332,7 +332,7 @@ lsquic_prq_new_req (struct pr_queue *prq, enum packet_req_type type,
     req->pr_version  = version;
     req->pr_scid     = *scid;
     req->pr_path.np_peer_ctx = peer_ctx;
-    memcpy(NP_LOCAL_SA(&req->pr_path), local_addr,
+    memcpy(req->pr_path.np_local_addr, local_addr,
                                             sizeof(req->pr_path.np_local_addr));
     memcpy(NP_PEER_SA(&req->pr_path), peer_addr,
                                             sizeof(req->pr_path.np_peer_addr));