http2: reject PADDED frames whose Pad Length exceeds the payload - #29905
Merged
Claude / Claude Code Review
completed
Apr 29, 2026 in 28m 39s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/bun.js/api/bun/h2_frame_parser.zig:2034-2038 |
Stale comment references removed expression |
Annotations
Check warning on line 2038 in src/bun.js/api/bun/h2_frame_parser.zig
claude / Claude Code Review
Stale comment references removed expression
Nit: this comment says "avoid underflowing `frame.length - padding - 1`", but that exact expression was removed in 0060c89 when the computation below was rewritten to `data_region_end = frame.length - @as(usize, padding)` (line 2066) with the Pad Length octet handled via `@max(start_idx, 1)` instead. The guard itself is still correct — it protects `frame.length - padding` — only the back-quoted expression in the comment is stale; consider dropping the `- 1`.
Loading