Impact

There is a remotely exploitable vulnerability in our QPACK decoder that lets a remote attacker crash the implementation by making it allocate arbitrarily large amounts of memory.

1. LiteralReader::read() at line 304 in neqo-qpack/src/reader.rs reads a varint length and calls resize() with that length
2. There's no upper bound check on the length, allowing malicious input to specify an absurdly large value
3. When Vec::resize() tries to allocate, it panics with "capacity overflow"

Patches

Patch in the secure fork below.

Workarounds

None

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2003616
https://oss-fuzz.com/testcase-detail/4695808126812160
https://issues.oss-fuzz.com/issues/464682065