Skip to content

Commit fd148d3

Browse files
addaleaxtargos
addaleax
authored and
targos
committed
deps: update nghttp2 to 1.39.2
This includes mitigations for CVE-2019-9512/CVE-2019-9515. PR-URL: nodejs#29122 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 8ae79c9 commit fd148d3

6 files changed

Lines changed: 36 additions & 6 deletions

File tree

‎deps/nghttp2/lib/includes/nghttp2/nghttp2.h‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2648,6 +2648,17 @@ nghttp2_option_set_max_deflate_dynamic_table_size(nghttp2_option *option,
26482648
NGHTTP2_EXTERN void nghttp2_option_set_no_closed_streams(nghttp2_option *option,
26492649
int val);
26502650

2651+
/**
2652+
* @function
2653+
*
2654+
* This function sets the maximum number of outgoing SETTINGS ACK and
2655+
* PING ACK frames retained in :type:`nghttp2_session` object. If
2656+
* more than those frames are retained, the peer is considered to be
2657+
* misbehaving and session will be closed. The default value is 1000.
2658+
*/
2659+
NGHTTP2_EXTERN void nghttp2_option_set_max_outbound_ack(nghttp2_option *option,
2660+
size_t val);
2661+
26512662
/**
26522663
* @function
26532664
*

‎deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,14 @@
2929
* @macro
3030
* Version number of the nghttp2 library release
3131
*/
32-
#define NGHTTP2_VERSION "1.39.1"
32+
#define NGHTTP2_VERSION "1.39.2"
3333

3434
/**
3535
* @macro
3636
* Numerical representation of the version number of the nghttp2 library
3737
* release. This is a 24 bit number with 8 bits for major number, 8 bits
3838
* for minor and 8 bits for patch. Version 1.2.3 becomes 0x010203.
3939
*/
40-
#define NGHTTP2_VERSION_NUM 0x012701
40+
#define NGHTTP2_VERSION_NUM 0x012702
4141

4242
#endif /* NGHTTP2VER_H */

‎deps/nghttp2/lib/nghttp2_option.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,3 +116,8 @@ void nghttp2_option_set_no_closed_streams(nghttp2_option *option, int val) {
116116
option->opt_set_mask |= NGHTTP2_OPT_NO_CLOSED_STREAMS;
117117
option->no_closed_streams = val;
118118
}
119+
120+
void nghttp2_option_set_max_outbound_ack(nghttp2_option *option, size_t val) {
121+
option->opt_set_mask |= NGHTTP2_OPT_MAX_OUTBOUND_ACK;
122+
option->max_outbound_ack = val;
123+
}

‎deps/nghttp2/lib/nghttp2_option.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ typedef enum {
6666
NGHTTP2_OPT_MAX_SEND_HEADER_BLOCK_LENGTH = 1 << 8,
6767
NGHTTP2_OPT_MAX_DEFLATE_DYNAMIC_TABLE_SIZE = 1 << 9,
6868
NGHTTP2_OPT_NO_CLOSED_STREAMS = 1 << 10,
69+
NGHTTP2_OPT_MAX_OUTBOUND_ACK = 1 << 11,
6970
} nghttp2_option_flag;
7071

7172
/**
@@ -80,6 +81,10 @@ struct nghttp2_option {
8081
* NGHTTP2_OPT_MAX_DEFLATE_DYNAMIC_TABLE_SIZE
8182
*/
8283
size_t max_deflate_dynamic_table_size;
84+
/**
85+
* NGHTTP2_OPT_MAX_OUTBOUND_ACK
86+
*/
87+
size_t max_outbound_ack;
8388
/**
8489
* Bitwise OR of nghttp2_option_flag to determine that which fields
8590
* are specified.

‎deps/nghttp2/lib/nghttp2_session.c‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -457,6 +457,7 @@ static int session_new(nghttp2_session **session_ptr,
457457
(*session_ptr)->remote_settings.max_concurrent_streams = 100;
458458

459459
(*session_ptr)->max_send_header_block_length = NGHTTP2_MAX_HEADERSLEN;
460+
(*session_ptr)->max_outbound_ack = NGHTTP2_DEFAULT_MAX_OBQ_FLOOD_ITEM;
460461

461462
if (option) {
462463
if ((option->opt_set_mask & NGHTTP2_OPT_NO_AUTO_WINDOW_UPDATE) &&
@@ -516,6 +517,10 @@ static int session_new(nghttp2_session **session_ptr,
516517
option->no_closed_streams) {
517518
(*session_ptr)->opt_flags |= NGHTTP2_OPTMASK_NO_CLOSED_STREAMS;
518519
}
520+
521+
if (option->opt_set_mask & NGHTTP2_OPT_MAX_OUTBOUND_ACK) {
522+
(*session_ptr)->max_outbound_ack = option->max_outbound_ack;
523+
}
519524
}
520525

521526
rv = nghttp2_hd_deflate_init2(&(*session_ptr)->hd_deflater,
@@ -6857,7 +6862,7 @@ int nghttp2_session_add_ping(nghttp2_session *session, uint8_t flags,
68576862
mem = &session->mem;
68586863

68596864
if ((flags & NGHTTP2_FLAG_ACK) &&
6860-
session->obq_flood_counter_ >= NGHTTP2_MAX_OBQ_FLOOD_ITEM) {
6865+
session->obq_flood_counter_ >= session->max_outbound_ack) {
68616866
return NGHTTP2_ERR_FLOODED;
68626867
}
68636868

@@ -7002,7 +7007,7 @@ int nghttp2_session_add_settings(nghttp2_session *session, uint8_t flags,
70027007
return NGHTTP2_ERR_INVALID_ARGUMENT;
70037008
}
70047009

7005-
if (session->obq_flood_counter_ >= NGHTTP2_MAX_OBQ_FLOOD_ITEM) {
7010+
if (session->obq_flood_counter_ >= session->max_outbound_ack) {
70067011
return NGHTTP2_ERR_FLOODED;
70077012
}
70087013
}

‎deps/nghttp2/lib/nghttp2_session.h‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ typedef struct {
9797
response frames are stacked up, which leads to memory exhaustion.
9898
The value selected here is arbitrary, but safe value and if we have
9999
these frames in this number, it is considered suspicious. */
100-
#define NGHTTP2_MAX_OBQ_FLOOD_ITEM 10000
100+
#define NGHTTP2_DEFAULT_MAX_OBQ_FLOOD_ITEM 1000
101101

102102
/* The default value of maximum number of concurrent streams. */
103103
#define NGHTTP2_DEFAULT_MAX_CONCURRENT_STREAMS 0xffffffffu
@@ -258,8 +258,12 @@ struct nghttp2_session {
258258
size_t num_idle_streams;
259259
/* The number of bytes allocated for nvbuf */
260260
size_t nvbuflen;
261-
/* Counter for detecting flooding in outbound queue */
261+
/* Counter for detecting flooding in outbound queue. If it exceeds
262+
max_outbound_ack, session will be closed. */
262263
size_t obq_flood_counter_;
264+
/* The maximum number of outgoing SETTINGS ACK and PING ACK in
265+
outbound queue. */
266+
size_t max_outbound_ack;
263267
/* The maximum length of header block to send. Calculated by the
264268
same way as nghttp2_hd_deflate_bound() does. */
265269
size_t max_send_header_block_length;

0 commit comments

Comments
 (0)