-
Notifications
You must be signed in to change notification settings - Fork 35
Closed
Labels
Description
Found when fuzzing hyper-h2 with afl:
Traceback (most recent call last):
File "script.py", line 10, in <module>
c.receive_data(sys.stdin.read())
File "/Users/cory/tmp/fuzz-results/env/lib/python2.7/site-packages/h2/connection.py", line 891, in receive_data
for frame in self.incoming_buffer:
File "/Users/cory/tmp/fuzz-results/env/lib/python2.7/site-packages/h2/frame_buffer.py", line 159, in next
f.parse_body(memoryview(self.data[9:9+length]))
File "/Users/cory/tmp/fuzz-results/env/lib/python2.7/site-packages/hyperframe/frame.py", line 706, in parse_body
self.parse_origin(data[pos:])
File "/Users/cory/tmp/fuzz-results/env/lib/python2.7/site-packages/hyperframe/frame.py", line 682, in parse_origin
scheme, hostport = data.split(b'://')
ValueError: need more than 1 value to unpackWe should aim to raise a hyperframe-specific exception here, not just a ValueError. We then need to catch it in hyper-h2.