h2
h2 copied to clipboard
Out of bounds access in h2::hpack::table::Table::index_dynamic
On v0.3.7. I saw this panic in our service. Unfortunately I was not able to capture the input that caused this. It seems it is related to the soundness of the index there. But I don't understand it enough. So I just log the issue here in case anyone knows anything about it.
Application Specific Information:
Out of bounds access
Thread 0 Crashed:
0 std std::sys_common::backtrace::__rust_end_short_backtrace (backtrace.rs:141)
1 <unknown> rust_begin_unwind (panicking.rs:515)
2 core core::panicking::panic_fmt (panicking.rs:92)
3 core core::option::expect_failed (option.rs:1243)
4 core [inlined] core::option::Option<T>::expect (option.rs:351)
5 alloc [inlined] alloc::collections::vec_deque::VecDeque<T>::index (mod.rs:2724)
6 h2 [inlined] h2::hpack::table::Table::index_dynamic (table.rs:193)
7 h2 [inlined] h2::hpack::table::Table::index (table.rs:157)
8 h2 [inlined] h2::hpack::encoder::Encoder::encode (encoder.rs:77)
9 h2 h2::frame::headers::HeaderBlock::into_encoding (headers.rs:904)
10 h2 h2::frame::headers::Headers::encode (headers.rs:268)
11 h2 [inlined] h2::codec::framed_write::Encoder<T>::buffer (framed_write.rs:264)
12 h2 [inlined] h2::codec::framed_write::FramedWrite<T>::buffer (framed_write.rs:115)
13 h2 h2::codec::Codec<T>::buffer (mod.rs:141)
14 h2 [inlined] h2::proto::streams::prioritize::Prioritize::poll_complete (prioritize.rs:505)
15 h2 [inlined] h2::proto::streams::send::Send::poll_complete (send.rs:297)
16 h2 h2::proto::streams::streams::Inner::poll_complete (streams.rs:850)
17 h2 [inlined] h2::proto::streams::streams::Streams<T>::poll_complete (streams.rs:180)
18 h2 [inlined] h2::proto::connection::Connection<T>::poll (connection.rs:253)
19 h2 h2::client::Connection<T>::poll (client.rs:1279)