ls-qpack
ls-qpack copied to clipboard
Decoder miscalculates compression ratio
In the function header_out_write_value()
, the counter qpd_bytes_out
is updated after dhi_process_header()
is called, instead of before:
r = dec->qpd_dh_if->dhi_process_header(read_ctx->hbrc_hblock, xhdr);
if (r == 0)
dec->qpd_bytes_out += xhdr->name_len + xhdr->val_len;
The problem here is that the user callback is free to modify xhdr
in any manner, potentially making name_len
and val_len
invalid.