Skip to content

http/hpack: fix integer encoding at the prefix maximum - #244

Merged
daurnimator merged 1 commit into
daurnimator:masterfrom
zeen:fix-hpack-prefix-boundary
Oct 6, 2026
Merged

daurnimator merged 1 commit into
daurnimator:masterfrom
zeen:fix-hpack-prefix-boundary

Conversation

@zeen

@zeen zeen commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Encoding an integer equal to the HPACK prefix maximum (2^N - 1) currently omits the required zero continuation byte. The decoder then consumes the next field's byte as part of the integer, potentially corrupting the header block
and causing an HTTP/2 connection error.

For example, encoding 31 with a five-bit prefix and mask 0 produces 1f instead of 1f 00. Decoding the current encoding followed by x yields 151 instead of 31.

RFC 7541 section 5.1 specifies that the single-byte representation applies only when I < 2^N - 1: https://www.rfc-editor.org/rfc/rfc7541.html#section-5.1

Minimal reproducer:

local hpack = require "http.hpack"
assert(hpack.encode_integer(31, 5, 0) == "\31\0")

Signed-off-by: Waqas Hussain <waqas20@gmail.com>

@daurnimator daurnimator left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! And great clean PR!

@daurnimator
daurnimator merged commit 0bb0036 into daurnimator:master Oct 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants