Hyper: crash with DNS-over-HTTPS

[gvanem]

I did this

Built libcurl with USE_HYPER and issuing this command:
curl.exe --doh-url https://cloudflare-dns.com/dns-query https://www.vg.no

I expected the following

The command not to crash. Which it did with this call-stack:

libcurl!dyn_nappend(struct dynbuf * s = 0x00000000, unsigned char * mem = 0x0fb7abc8 "HTTP/2 200 OK..", unsigned int len = 0xf)+0xc
libcurl!doh_write_cb(void * contents = 0x0fb7abc8, unsigned int size = 1, unsigned int nmemb = 0xf, void * userp = 0x00000000)+0x18
libcurl!hyperstream(struct Curl_easy * data = 0x0fa4cd60, struct connectdata * conn = 0x0fa2ebe0, int * didwhat = 0x00def684, bool * done = 0x00def6a3, int select_res = 0n2)+0x219
libcurl!Curl_readwrite(struct connectdata * conn = 0x0fa2ebe0, struct Curl_easy * data = 0x0fa4cd60, bool * done = 0x00def6a3, bool * comeback = 0x00def6a4)+0xb9
libcurl!multi_runsingle(struct Curl_multi * multi = 0x0d53cbf8, struct curltime * nowp = 0x00def728, struct Curl_easy * data = 0x0fa4cd60)+0xee5
libcurl!curl_multi_perform(struct Curl_multi * multi = 0x0d53cbf8, int * running_handles = 0x00def76c)+0x5c
libcurl!curl_easy_perform(struct Curl_easy * data = 0x0fa04330)+0xe0
curl!run_all_transfers(struct GlobalConfig * global = 0x00def7d0, struct Curl_share * share = 0x0defbc68, CURLcode result = <Value unavailable error>)+0xb6
curl!operate(struct GlobalConfig * global = 0x00def7d0, int argc = 0n10, char ** argv = <Value unavailable error>)+0x1ad
curl!main(int argc = 0n10, char ** argv = 0x011fad20)+0x194

Inspecting the parameters in the doh_write_cb() callback:

static size_t
doh_write_cb(const void *contents, size_t size, size_t nmemb, void *userp)
{
  size_t realsize = size * nmemb;
  struct dynbuf *mem = (struct dynbuf *)userp;

  if(Curl_dyn_addn(mem, contents, realsize))
    return 0;
  ...

I saw a mem == NULL!

curl/libcurl version

curl 7.75.0-DEV (i386-pc-win32) libcurl/7.75.0-DEV OpenSSL/3.0.0 (Schannel) zlib/1.2.11 brotli/1.0.0 zstd/1.4.4 c-ares/1.17.0 WinIDN libssh2/1.9.0_DEV nghttp2/1.39.0 librtmp/2.3 Hyper/0.13.8
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtmp scp sftp smb smbs smtp smtps  telnet tftp
Features: AsynchDNS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile MultiSSL NTLM SPNEGO SSL SSPI TLS-SRP UnixSockets alt-svc brotli libz zstd

operating system

Windows-10.

Building without a -DUSE_HYPER, there is no crash.

[bagder]

Added to https://github.com/curl/curl/wiki/Hyper as remaining work.

[bagder]

If nobody else than me is interested in fixing this issue then I'm probably going to close it soon as a "known bug". I can certainly reproduce the problem but I want to get more of the fundamental stuff to work with Hyper first before I take on DoH.

[gvanem]

Just to add, with a libcurl built with -DDEBUGBUILD, this is the last output:

* HTTP 1.1 or later with persistent connection
< HTTP/1.1 200 OK
Assertion failed: s, file dynbuf.c, line 161

Adding something to a NULL-dynbuf.

[gvanem]

And a set curl_ssl_backend=rustls & curl.exe -v --doh-url https://cloudflare-dns.com/dns-query https://www.vg.no
gives:

...
* rustls_recv: EAGAIN or EWOULDBLOCK
* Hyper: operation was canceled: connection closed before message completed
* multi_done
* Connection #1 to host cloudflare-dns.com left intact
* Expire cleared (transfer 0xf8eccd8)
* a DOH request is completed, 0 to go
* DOH request Out of memory
* DOH: Too small type A for www.vg.no
* DOH: Too small type AAAA for www.vg.no
* The cache now contains 0 members
* Closing connection 0
* Expire cleared (transfer 0xf8fc6f8)
curl: (6) Couldn't resolve host name
* WARNING: Using weak random seed

Out of memory, what?!

[bagder]

DoH is not made to work with Hyper yet. You will get all sorts of errors trying to use this until fixed.

[nnethercote]

An update: it appears that DoH does now work with Hyper. The example given at the top of this issue works fine with Hyper. Also, https://github.com/curl/curl/wiki/Hyper has an entry on October 27, 2021 (almost 10 months after this issue was file) that says "I verified that DoH works with hyper builds".

[bdaehlie]

@bagder Seems like we should remove the KNOWN_BUGS tag?