From 21cbb01d32f3e78aed6939d4ba4f4560ba4019ab Mon Sep 17 00:00:00 2001 From: Oskar Eichler Date: Sat, 29 Aug 2026 23:49:07 +0200 Subject: [PATCH] Validate stream and window update ranges --- lib/http/2/framer.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/http/2/framer.rb b/lib/http/2/framer.rb index 3643810..3e63b5c 100644 --- a/lib/http/2/framer.rb +++ b/lib/http/2/framer.rb @@ -130,10 +130,10 @@ def common_header(frame, buffer:) stream_id = frame.fetch(:stream, 0) - raise CompressionError, "Stream ID (#{stream_id}) is too large" if stream_id > MAX_STREAM_ID + raise CompressionError, "Stream ID (#{stream_id}) is outside the valid range" unless stream_id.between?(0, MAX_STREAM_ID) - if type == :window_update && frame[:increment] > MAX_WINDOWINC - raise CompressionError, "Window increment (#{frame[:increment]}) is too large" + if type == :window_update && !frame[:increment].between?(1, MAX_WINDOWINC) + raise CompressionError, "Window increment (#{frame[:increment]}) is outside the valid range" end flags = frame[:flags]