Fix XPACK relative index underflow#13144
Merged
Merged
Conversation
XPACK dynamic table lookups convert absolute matches into HPACK relative indexes. If an impossible future absolute index reached that conversion path, unsigned subtraction could wrap and report a bogus relative index. This guards the conversion by preserving unmatched lookup results and rejecting absolute indexes beyond the current dynamic-table head before subtracting. This also adds XPACK unit coverage for empty, missing, and normal relative lookup results.
bneradt
force-pushed
the
fix-xpack-relative-index-underflow
branch
from
0c8713e to
5205a5c
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens XPACK dynamic-table relative index lookups by preventing unsigned underflow / wraparound when converting an absolute match index into an HPACK-style relative index, especially for empty tables and impossible/invalid match indexes. It also adds unit tests to cover empty, missing, and normal relative-lookup behavior.
Changes:
- Add guards in
XpackDynamicTable::lookup_relative(name, value)to early-return on no-match and reject absolute indexes beyond the current head before subtracting. - Add unit test coverage for
lookup_relative()returning{index=0, match_type=NONE}on empty tables and missing entries, plus expected relative indexes for normal matches.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
src/proxy/hdrs/XPACK.cc |
Prevents relative index underflow by guarding the absolute→relative index conversion on no-match and out-of-range indexes. |
src/proxy/hdrs/unit_tests/test_XPACK.cc |
Adds unit coverage for empty/missing lookups and validates correct relative indexes for existing entries. |
maskit
approved these changes
May 8, 2026
Contributor
|
Cherry-picked to 10.2.x |
cmcfarlen
pushed a commit
that referenced
this pull request
May 14, 2026
XPACK dynamic table lookups convert absolute matches into HPACK relative indexes. If an impossible future absolute index reached that conversion path, unsigned subtraction could wrap and report a bogus relative index. This guards the conversion by preserving unmatched lookup results and rejecting absolute indexes beyond the current dynamic-table head before subtracting. This also adds XPACK unit coverage for empty, missing, and normal relative lookup results. (cherry picked from commit e698e46)
Contributor
|
Cherry-picked to 10.1.x branch |
cmcfarlen
pushed a commit
that referenced
this pull request
May 18, 2026
XPACK dynamic table lookups convert absolute matches into HPACK relative indexes. If an impossible future absolute index reached that conversion path, unsigned subtraction could wrap and report a bogus relative index. This guards the conversion by preserving unmatched lookup results and rejecting absolute indexes beyond the current dynamic-table head before subtracting. This also adds XPACK unit coverage for empty, missing, and normal relative lookup results. (cherry picked from commit e698e46)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
XPACK dynamic-table lookups convert absolute match indexes into HPACK relative indexes. A missing guard allowed the unsigned subtraction to wrap if an impossible future absolute index reached that conversion path.
This guards the conversion by returning unmatched results before reading the table head and by rejecting absolute indexes beyond the current head. This also adds XPACK unit coverage for empty, missing, and normal relative lookup results.