From 10b7b7fcf06d4ed5492e946ac93eb232c168e686 Mon Sep 17 00:00:00 2001 From: Lena Biliaieva Date: Mon, 1 Jul 2024 14:57:41 +0200 Subject: [PATCH] QHttp2Connection: Return connection error if CONTINUATION isn't expected MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit According to RFC 9113: A CONTINUATION frame MUST be preceded by a HEADERS, PUSH_PROMISE or CONTINUATION frame without the END_HEADERS flag set. A recipient that observes violation of this rule MUST respond with a connection error of type PROTOCOL_ERROR. Pick-to: 6.8 Task-number: QTBUG-122458 Change-Id: I1a052b1f4fc80aa73fad4fc18e3c063fb738ae4e Reviewed-by: Øystein Heskestad Reviewed-by: Edward Welbourne --- src/network/access/qhttp2connection.cpp | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/network/access/qhttp2connection.cpp b/src/network/access/qhttp2connection.cpp index 2b7f8b66e48..851269b5039 100644 --- a/src/network/access/qhttp2connection.cpp +++ b/src/network/access/qhttp2connection.cpp @@ -1575,6 +1575,9 @@ void QHttp2Connection::handleCONTINUATION() if (continuedFrames.empty()) return connectionError(PROTOCOL_ERROR, "CONTINUATION without a preceding HEADERS or PUSH_PROMISE"); + if (!continuationExpected) + return connectionError(PROTOCOL_ERROR, + "CONTINUATION after a frame with the END_HEADERS flag set"); if (inboundFrame.streamID() != continuedFrames.front().streamID()) return connectionError(PROTOCOL_ERROR, "CONTINUATION on invalid stream");