Skip to content

http2: reject PADDED frames whose Pad Length exceeds the payload - #29905

Merged
Jarred-Sumner merged 9 commits into
mainfrom
farm/0685f7a5/h2-padding-underflow
Apr 29, 2026
Merged

http2: reject PADDED frames whose Pad Length exceeds the payload#29905
Jarred-Sumner merged 9 commits into
mainfrom
farm/0685f7a5/h2-padding-underflow

test: clean up client/server in receiveBody on rejection

ca76114
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Apr 29, 2026 in 28m 39s

Code review found 1 potential issue

Found 1 candidates, confirmed 1. See review comments for details.

Details

Severity Count
🔴 Important 0
🟡 Nit 1
🟣 Pre-existing 0
Severity File:Line Issue
🟡 Nit src/bun.js/api/bun/h2_frame_parser.zig:2034-2038 Stale comment references removed expression

Annotations

Check warning on line 2038 in src/bun.js/api/bun/h2_frame_parser.zig

See this annotation in the file changed.

@claude claude / Claude Code Review

Stale comment references removed expression

Nit: this comment says "avoid underflowing `frame.length - padding - 1`", but that exact expression was removed in 0060c89 when the computation below was rewritten to `data_region_end = frame.length - @as(usize, padding)` (line 2066) with the Pad Length octet handled via `@max(start_idx, 1)` instead. The guard itself is still correct — it protects `frame.length - padding` — only the back-quoted expression in the comment is stale; consider dropping the `- 1`.