Skip to content

Reject empty HPACK header names - #3694

Merged
chenBright merged 1 commit into
apache:masterfrom
wwbmmm:oncall/req-20261023-033147
Nov 1, 2026
Merged

chenBright merged 1 commit into
apache:masterfrom
wwbmmm:oncall/req-20261023-033147

Conversation

@wwbmmm

@wwbmmm wwbmmm commented Oct 31, 2026

Copy link
Copy Markdown
Contributor

What problem does this PR solve?

Issue Number: resolve N/A

Problem Summary:

The HPACK decoder accepts a zero-length literal header name, which RFC 7541 forbids. DecodeString() returns the number of wire bytes consumed (1 for the 0x00 length octet), not the decoded string length, so the existing name_bytes <= 0 check does not reject an empty name. The resulting Header{name=""} is then passed to IndexTable::AddHeader(), whose CHECK(!h.name.empty()) aborts the process when the header uses incremental indexing. A malformed HEADERS frame can therefore terminate the server.

What is changed and the side effects?

Changed:

  • HPacker::DecodeWithKnownPrefix() now rejects an empty decoded header name and returns -1, so malformed input is reported as a protocol error and the connection is closed instead of aborting the process.
  • Added HPackTest.empty_header_name covering literal header fields with incremental indexing, without indexing, never indexed, and a Huffman-encoded empty name.

Side effects:

  • Performance effects: none; the new check runs once per literal header field with a decoded name.

  • Breaking backward compatibility: none for valid HPACK input, since an empty header name is invalid per RFC 7541.


Check List:

Tests run:

  • build/test/brpc_hpack_unittest --gtest_filter=HPackTest.empty_header_name (passes; fails/aborts without the fix)
  • build/test/brpc_hpack_unittest (all other cases pass; many_dynamic_table_size_updates fails before and after this change because pthread_attr_setstacksize(64K) returns EINVAL in this environment)
  • build/test/brpc_http_rpc_protocol_unittest --gtest_filter='*http2*:*h2_*' (23/23 pass)

🤖 This PR was automatically created by brpc-oncall

@chenBright chenBright left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@chenBright
chenBright merged commit f80d6b8 into apache:master Nov 1, 2026
29 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants