Skip to content

Off-by-one in _pad: pad-length byte not accounted for in overflow check #3

@phluid61

Description

@phluid61

File: lib/ruby-h2/http-agent.rb:459

The check len + rem > @max_frame_size does not account for the 1-byte pad-length field that is prepended on line 467. When len + rem == @max_frame_size, the condition is false, but the total payload becomes @max_frame_size + 1 after prepending the pad-length byte — exceeding MAX_FRAME_SIZE by one byte.

The peer would reject this with FRAME_SIZE_ERROR.

Fix: change the condition to len + rem + 1 > @max_frame_size (or equivalently len + rem >= @max_frame_size).

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions