What happened?
RFC 9000 Section 4.2: Maximum Data字段MUST NOT超过2^62-1。
xqc_stream_do_recv_flow_ctl 中窗口指数增长时无溢出保护。
xquic 代码位置: [xqc_stream.c:377-474]
xqc_stream_do_recv_flow_ctl
stream->stream_flow_ctl.fc_max_stream_data_can_recv
+= (stream->stream_flow_ctl.fc_stream_recv_window_size - available_window);
// 缺少: 检查是否超过 2^62-1
修复建议: 添加上限检查:
#define XQC_MAX_FLOW_CONTROL_LIMIT ((uint64_t)1 << 62)
if (new_limit > XQC_MAX_FLOW_CONTROL_LIMIT) {
new_limit = XQC_MAX_FLOW_CONTROL_LIMIT;
}
Steps To Reproduce
Information and Steps to reproduce the behavior.
Relevant log output
What happened?
RFC 9000 Section 4.2: Maximum Data字段MUST NOT超过2^62-1。
xqc_stream_do_recv_flow_ctl 中窗口指数增长时无溢出保护。
xquic 代码位置: [xqc_stream.c:377-474]
xqc_stream_do_recv_flow_ctl
stream->stream_flow_ctl.fc_max_stream_data_can_recv
+= (stream->stream_flow_ctl.fc_stream_recv_window_size - available_window);
// 缺少: 检查是否超过 2^62-1
修复建议: 添加上限检查:
#define XQC_MAX_FLOW_CONTROL_LIMIT ((uint64_t)1 << 62)
if (new_limit > XQC_MAX_FLOW_CONTROL_LIMIT) {
new_limit = XQC_MAX_FLOW_CONTROL_LIMIT;
}
Steps To Reproduce
Information and Steps to reproduce the behavior.
Relevant log output