deps: update nghttp3 to 1.19.0

deps/ngtcp2/nghttp3/lib/includes/nghttp3/nghttp3.h

@@ -1871,12 +1871,13 @@ typedef struct nghttp3_settings {
      NGHTTP3_SETTINGS_V3. */
   /**
    * :member:`glitch_ratelim_burst` is the maximum number of tokens
-   * available to "glitch" rate limiter.  "glitch" is a suspicious
-   * activity from a remote endpoint.  If detected, certain amount of
-   * tokens are consumed.  If no tokens are available to consume, the
-   * connection is closed.  The rate of token generation is specified
-   * by :member:`glitch_ratelim_rate`.  This feature is enabled only
-   * when `nghttp3_conn_read_stream2` is used.
+   * available to "glitch" rate limiter.  It is clamped to UINT64_MAX
+   * / NGHTTP3_SECONDS.  "glitch" is a suspicious activity from a
+   * remote endpoint.  If detected, certain amount of tokens are
+   * consumed.  If no tokens are available to consume, the connection
+   * is closed.  The rate of token generation is specified by
+   * :member:`glitch_ratelim_rate`.  This feature is enabled only when
+   * `nghttp3_conn_read_stream2` is used.
    *
    * .. version-added:: 1.12.0
    */
@@ -3089,6 +3090,8 @@ typedef struct nghttp3_data_reader {
  *     Stream has already been opened.
  * :macro:`NGHTTP3_ERR_NOMEM`
  *     Out of memory.
+ * :macro:`NGHTTP3_ERR_INVALID_ARGUMENT`
+ *     The required memory for |nva| of length |nvlen| is too large.
  */
 NGHTTP3_EXTERN int nghttp3_conn_submit_request(
   nghttp3_conn *conn, int64_t stream_id, const nghttp3_nv *nva, size_t nvlen,
@@ -3108,6 +3111,8 @@ NGHTTP3_EXTERN int nghttp3_conn_submit_request(
  *     Stream not found
  * :macro:`NGHTTP3_ERR_NOMEM`
  *     Out of memory.
+ * :macro:`NGHTTP3_ERR_INVALID_ARGUMENT`
+ *     The required memory for |nva| of length |nvlen| is too large.
  */
 NGHTTP3_EXTERN int nghttp3_conn_submit_info(nghttp3_conn *conn,
                                             int64_t stream_id,
@@ -3130,6 +3135,8 @@ NGHTTP3_EXTERN int nghttp3_conn_submit_info(nghttp3_conn *conn,
  *     Stream not found
  * :macro:`NGHTTP3_ERR_NOMEM`
  *     Out of memory.
+ * :macro:`NGHTTP3_ERR_INVALID_ARGUMENT`
+ *     The required memory for |nva| of length |nvlen| is too large.
  */
 NGHTTP3_EXTERN int nghttp3_conn_submit_response(nghttp3_conn *conn,
                                                 int64_t stream_id,
@@ -3154,6 +3161,8 @@ NGHTTP3_EXTERN int nghttp3_conn_submit_response(nghttp3_conn *conn,
  *     Application has already submitted fin to stream.
  * :macro:`NGHTTP3_ERR_NOMEM`
  *     Out of memory.
+ * :macro:`NGHTTP3_ERR_INVALID_ARGUMENT`
+ *     The required memory for |nva| of length |nvlen| is too large.
  */
 NGHTTP3_EXTERN int nghttp3_conn_submit_trailers(nghttp3_conn *conn,
                                                 int64_t stream_id,

deps/ngtcp2/nghttp3/lib/includes/nghttp3/version.h

@@ -31,7 +31,7 @@
  *
  * Version number of the nghttp3 library release.
  */
-#define NGHTTP3_VERSION "1.18.0"
+#define NGHTTP3_VERSION "1.19.0"
 
 /**
  * @macro
@@ -41,6 +41,6 @@
  * number, 8 bits for minor and 8 bits for patch. Version 1.2.3
  * becomes 0x010203.
  */
-#define NGHTTP3_VERSION_NUM 0x011200
+#define NGHTTP3_VERSION_NUM 0x011300
 
 #endif /* !defined(NGHTTP3_VERSION_H) */

deps/ngtcp2/nghttp3/lib/nghttp3_balloc.c

@@ -67,7 +67,7 @@ int nghttp3_balloc_get(nghttp3_balloc *balloc, void **pbuf, size_t n) {
 
   if (nghttp3_buf_left(&balloc->buf) < n) {
     p = nghttp3_mem_malloc(balloc->mem,
-                           sizeof(nghttp3_memblock_hd) + 0x8U + balloc->blklen);
+                           sizeof(nghttp3_memblock_hd) + 0xFU + balloc->blklen);
     if (p == NULL) {
       return NGHTTP3_ERR_NOMEM;
     }

deps/ngtcp2/nghttp3/lib/nghttp3_buf.c

@@ -25,13 +25,15 @@
  */
 #include "nghttp3_buf.h"
 
-void nghttp3_buf_init(nghttp3_buf *buf) {
-  buf->begin = buf->end = buf->pos = buf->last = NULL;
-}
+void nghttp3_buf_init(nghttp3_buf *buf) { *buf = (nghttp3_buf){0}; }
 
 void nghttp3_buf_wrap_init(nghttp3_buf *buf, uint8_t *src, size_t len) {
-  buf->begin = buf->pos = buf->last = src;
-  buf->end = buf->begin + len;
+  *buf = (nghttp3_buf){
+    .begin = src,
+    .end = src + len,
+    .pos = src,
+    .last = src,
+  };
 }
 
 void nghttp3_buf_free(nghttp3_buf *buf, const nghttp3_mem *mem) {

deps/ngtcp2/nghttp3/lib/nghttp3_conn.c

@@ -555,13 +555,14 @@ nghttp3_ssize nghttp3_conn_read_stream2(nghttp3_conn *conn, int64_t stream_id,
     return 0;
   }
 
+  if (fin) {
+    stream->flags |= NGHTTP3_STREAM_FLAG_READ_EOF;
+  }
+
   if (nghttp3_stream_uni(stream_id)) {
     return nghttp3_conn_read_uni(conn, stream, src, srclen, fin, ts);
   }
 
-  if (fin) {
-    stream->flags |= NGHTTP3_STREAM_FLAG_READ_EOF;
-  }
   return nghttp3_conn_read_bidi(conn, &bidi_nproc, stream, src, srclen, fin,
                                 ts);
 }
@@ -1126,6 +1127,13 @@ nghttp3_ssize nghttp3_conn_read_control(nghttp3_conn *conn,
         break;
       }
 
+      /* Apply buffer limits here even if everything is in the input
+         buffer. */
+      if (rstate->left > sizeof(conn->rx.pri_fieldbuf)) {
+        rstate->state = NGHTTP3_CTRL_STREAM_STATE_IGN_FRAME;
+        break;
+      }
+
       conn->rx.pri_fieldbuflen = 0;
 
       rstate->state = NGHTTP3_CTRL_STREAM_STATE_PRIORITY_UPDATE;
@@ -1141,22 +1149,12 @@ nghttp3_ssize nghttp3_conn_read_control(nghttp3_conn *conn,
       len = (size_t)nghttp3_min(rstate->left, (uint64_t)(end - p));
       assert(len > 0);
       if (conn->rx.pri_fieldbuflen == 0 && rstate->left == len) {
-        /* Everything is in the input buffer.  Apply same length
-           limit we impose when buffering the field. */
-        if (len > sizeof(conn->rx.pri_fieldbuf)) {
-          busy = 1;
-          rstate->state = NGHTTP3_CTRL_STREAM_STATE_IGN_FRAME;
-          break;
-        }
-
+        /* Everything is in the input buffer. */
         pri_field_value = p;
         pri_field_valuelen = len;
-      } else if (len + conn->rx.pri_fieldbuflen >
-                 sizeof(conn->rx.pri_fieldbuf)) {
-        busy = 1;
-        rstate->state = NGHTTP3_CTRL_STREAM_STATE_IGN_FRAME;
-        break;
       } else {
+        assert(len + conn->rx.pri_fieldbuflen <= sizeof(conn->rx.pri_fieldbuf));
+
         memcpy(conn->rx.pri_fieldbuf + conn->rx.pri_fieldbuflen, p, len);
         conn->rx.pri_fieldbuflen += len;
 
@@ -1975,6 +1973,12 @@ int nghttp3_conn_on_settings_entry_received(nghttp3_conn *conn,
       break;
     }
 
+#if SIZE_MAX < UINT64_MAX
+    if (ent->value > SIZE_MAX) {
+      return NGHTTP3_ERR_H3_SETTINGS_ERROR;
+    }
+#endif /* SIZE_MAX < UINT64_MAX */
+
     dest->qpack_max_dtable_capacity = (size_t)ent->value;
 
     nghttp3_qpack_encoder_set_max_dtable_capacity(&conn->qenc,
@@ -1989,6 +1993,12 @@ int nghttp3_conn_on_settings_entry_received(nghttp3_conn *conn,
       break;
     }
 
+#if SIZE_MAX < UINT64_MAX
+    if (ent->value > SIZE_MAX) {
+      return NGHTTP3_ERR_H3_SETTINGS_ERROR;
+    }
+#endif /* SIZE_MAX < UINT64_MAX */
+
     dest->qpack_blocked_streams = (size_t)ent->value;
 
     nghttp3_qpack_encoder_set_max_blocked_streams(
@@ -2957,6 +2967,8 @@ int nghttp3_conn_set_client_stream_priority(nghttp3_conn *conn,
     memcpy(buf, data, datalen);
   }
 
+  assert(conn->tx.ctrl);
+
   rv = nghttp3_stream_frq_emplace(conn->tx.ctrl, &fr);
   if (rv != 0) {
     nghttp3_mem_free(conn->mem, buf);

deps/ngtcp2/nghttp3/lib/nghttp3_frame.c

@@ -136,8 +136,8 @@ size_t nghttp3_frame_write_origin_len(uint64_t *ppayloadlen,
 int nghttp3_nva_copy(nghttp3_nv **pnva, const nghttp3_nv *nva, size_t nvlen,
                      const nghttp3_mem *mem) {
   size_t i;
-  uint8_t *data = NULL;
-  size_t buflen = 0;
+  uint8_t *data;
+  size_t buflen;
   nghttp3_nv *p;
 
   if (nvlen == 0) {
@@ -146,18 +146,32 @@ int nghttp3_nva_copy(nghttp3_nv **pnva, const nghttp3_nv *nva, size_t nvlen,
     return 0;
   }
 
+  if (sizeof(nghttp3_nv) > SIZE_MAX / nvlen) {
+    return NGHTTP3_ERR_INVALID_ARGUMENT;
+  }
+
+  buflen = sizeof(nghttp3_nv) * nvlen;
+
   for (i = 0; i < nvlen; ++i) {
     /* + 1 for null-termination */
     if ((nva[i].flags & NGHTTP3_NV_FLAG_NO_COPY_NAME) == 0) {
+      if (nva[i].namelen == SIZE_MAX ||
+          buflen > SIZE_MAX - nva[i].namelen - 1) {
+        return NGHTTP3_ERR_INVALID_ARGUMENT;
+      }
+
       buflen += nva[i].namelen + 1;
     }
     if ((nva[i].flags & NGHTTP3_NV_FLAG_NO_COPY_VALUE) == 0) {
+      if (nva[i].valuelen == SIZE_MAX ||
+          buflen > SIZE_MAX - nva[i].valuelen - 1) {
+        return NGHTTP3_ERR_INVALID_ARGUMENT;
+      }
+
       buflen += nva[i].valuelen + 1;
     }
   }
 
-  buflen += sizeof(nghttp3_nv) * nvlen;
-
   *pnva = nghttp3_mem_malloc(mem, buflen);
 
   if (*pnva == NULL) {
@@ -169,30 +183,28 @@ int nghttp3_nva_copy(nghttp3_nv **pnva, const nghttp3_nv *nva, size_t nvlen,
 
   for (i = 0; i < nvlen; ++i) {
     p->flags = nva[i].flags;
+    p->namelen = nva[i].namelen;
+    p->valuelen = nva[i].valuelen;
 
     if (nva[i].flags & NGHTTP3_NV_FLAG_NO_COPY_NAME) {
       p->name = nva[i].name;
-      p->namelen = nva[i].namelen;
     } else {
       if (nva[i].namelen) {
         memcpy(data, nva[i].name, nva[i].namelen);
         nghttp3_downcase(data, nva[i].namelen);
       }
       p->name = data;
-      p->namelen = nva[i].namelen;
       data[p->namelen] = '\0';
       data += nva[i].namelen + 1;
     }
 
     if (nva[i].flags & NGHTTP3_NV_FLAG_NO_COPY_VALUE) {
       p->value = nva[i].value;
-      p->valuelen = nva[i].valuelen;
     } else {
       if (nva[i].valuelen) {
         memcpy(data, nva[i].value, nva[i].valuelen);
       }
       p->value = data;
-      p->valuelen = nva[i].valuelen;
       data[p->valuelen] = '\0';
       data += nva[i].valuelen + 1;
     }

deps/ngtcp2/nghttp3/lib/nghttp3_frame.h

@@ -247,6 +247,8 @@ size_t nghttp3_frame_write_origin_len(uint64_t *ppayloadlen,
  *
  * NGHTTP3_ERR_NOMEM
  *     Out of memory.
+ * NGHTTP3_ERR_INVALID_ARGUMENT
+ *     The required memory for |nva| of length |nvlen| is too large.
  */
 int nghttp3_nva_copy(nghttp3_nv **pnva, const nghttp3_nv *nva, size_t nvlen,
                      const nghttp3_mem *mem);