Merge commit from fork

Author: whatyouhide

lib/mint/http2.ex

@@ -2438,16 +2438,23 @@ defmodule Mint.HTTP2 do
       conn = put_in(conn.headers_being_processed, nil)
       callback.(conn, responses, hbf, stream)
     else
-      new_size = acc_size + byte_size(hbf_chunk)
-      conn = assert_header_block_within_max_size(conn, new_size)
+      if byte_size(hbf_chunk) == 0 do
+        # An empty fragment does not contribute header-block data. Keeping the
+        # existing accumulator avoids adding an unbounded number of empty
+        # iodata nodes when END_HEADERS is withheld.
+        {conn, responses}
+      else
+        new_size = acc_size + byte_size(hbf_chunk)
+        conn = assert_header_block_within_max_size(conn, new_size)
 
-      conn =
-        put_in(
-          conn.headers_being_processed,
-          {stream_id, [hbf_acc, hbf_chunk], callback, new_size}
-        )
+        conn =
+          put_in(
+            conn.headers_being_processed,
+            {stream_id, [hbf_acc, hbf_chunk], callback, new_size}
+          )
 
-      {conn, responses}
+        {conn, responses}
+      end
     end
   end
 
@@ -2461,8 +2468,9 @@ defmodule Mint.HTTP2 do
   # CONTINUATION frames is buffered (in compressed form) until END_HEADERS
   # arrives. A server can withhold END_HEADERS and stream CONTINUATION frames
   # indefinitely, so the buffered size is bounded by the locally advertised
-  # SETTINGS_MAX_HEADER_LIST_SIZE. The compressed accumulator is never larger
-  # than the uncompressed header list it decodes to, so this never rejects a
+  # SETTINGS_MAX_HEADER_LIST_SIZE. Empty fragments are not retained in the
+  # accumulator. The compressed accumulator is never larger than the
+  # uncompressed header list it decodes to, so the size limit never rejects a
   # header block that fits within the advertised limit.
   defp assert_header_block_within_max_size(conn, size) do
     case conn.client_settings.max_header_list_size do

test/mint/http2/conn_test.exs

@@ -1004,6 +1004,28 @@ defmodule Mint.HTTP2Test do
       refute HTTP2.open?(conn)
     end
 
+    # Regression for GitHub Security Advisory GHSA-8pf6-g464-h6h9.
+    test "empty CONTINUATION frames do not grow the header block accumulator", %{conn: conn} do
+      {conn, _ref} = open_request(conn)
+
+      assert_recv_frames [headers(stream_id: stream_id)]
+
+      empty_continuations =
+        List.duplicate(
+          continuation(stream_id: stream_id, hbf: "", flags: set_flags(:continuation, [])),
+          10_000
+        )
+
+      assert {:ok, %HTTP2{} = conn, []} =
+               stream_frames(conn, [
+                 headers(stream_id: stream_id, hbf: "", flags: set_flags(:headers, []))
+                 | empty_continuations
+               ])
+
+      assert {^stream_id, "", _callback, 0} = conn.headers_being_processed
+      assert HTTP2.open?(conn)
+    end
+
     @tag connect_options: [client_settings: [max_header_list_size: 1_000]]
     test "a single oversized HEADERS fragment past max_header_list_size is a connection error",
          %{conn: conn} do