Restricte variable integer decoding to uint32 to prevent run-away computation

Author: Kriechi

CHANGELOG.rst

@@ -17,7 +17,9 @@ dev
 
 - Headers marked as `sensitive` will no longer log their value at DEBUG level. Instead a placeholder value of `SENSITIVE_REDACTED` is logged.
 - Fixed perfect match missed for headers with empty values.
+- Restricted variable integer decoding to uint32 to prevent run-away computation. With thanks to `Hiroki Nishino`_.
 
+.. _Hiroki Nishino: https://github.com/tawAsh1
 
 4.1.0 (2025-01-22)
 ------------------

src/hpack/hpack.py

@@ -22,6 +22,8 @@
 INDEX_NEVER = b"\x10"
 INDEX_INCREMENTAL = b"\x40"
 
+VARINT_MAX_LENGTH = 5 # octets, enough for encoding prefix + uint32
+
 # Precompute 2^i for 1-8 for use in prefix calcs.
 # Zero index is not used but there to save a subtraction
 # as prefix numbers are not zero indexed.
@@ -106,6 +108,17 @@ def decode_integer(data: bytes | memoryview, prefix_bits: int) -> tuple[int, int
                     break
                 shift += 7
 
+                if index > VARINT_MAX_LENGTH:  # sanity check to prevent infinite loops
+                    # We have consumed more than enough bytes for a typical unsigned integer.
+                    # The maximum size is not defined in HPACK RFC7541 Section 5.1:
+                    #   > This integer representation allows for values of indefinite size.  It
+                    #   > is also possible for an encoder to send a large number of zero
+                    #   > values, which can waste octets and could be used to overflow integer
+                    #   > values.  Integer encodings that exceed implementation limits -- in
+                    #   > value or octet length -- MUST be treated as decoding errors.
+                    msg = f"Variable integer representation is too long: {data!r}"
+                    raise HPACKDecodingError(msg)
+
     except IndexError as err:
         msg = f"Unable to decode HPACK integer representation from {data!r}"
         raise HPACKDecodingError(msg) from err

tests/test_encode_decode.py

@@ -125,7 +125,7 @@ def test_decode_either_succeeds_or_raises_error(self, data, prefix_bits):
             assert consumed > 0
 
     @given(
-        integer=integers(min_value=0),
+        integer=integers(min_value=0, max_value=2**32),
         prefix_bits=integers(min_value=1, max_value=8)
     )
     def test_encode_decode_round_trips(self, integer, prefix_bits):
@@ -138,3 +138,10 @@ def test_encode_decode_round_trips(self, integer, prefix_bits):
         )
         assert integer == decoded_integer
         assert consumed > 0
+
+    def test_decode_too_long_fails(self):
+        """
+        If the variable integer representation is too long, the decoder fails.
+        """
+        with pytest.raises(HPACKDecodingError):
+            decode_integer(b'\xff\xff\xff\xff\xff\xff', 5)