quic_session_set_alpns() parses alpn_data into a fixed-size stack array without checking count against the array capacity:
gnutls_datum_t alpns[TLSHD_QUIC_MAX_ALPNS_LEN / 2]; /* 64 entries */
char *alpn = strtok(alpn_data, ",");
int count = 0;
while (alpn) {
...
alpns[count].data = ...;
count++;
...
}Today this is safe only by a size coincidence: conn->alpns is char[128], so at most 64 single-character, comma-separated tokens fit (127 chars + NUL). But nothing enforces that relationship - if TLSHD_QUIC_MAX_ALPNS_LEN is ever raised, or the caller's buffer is filled differently (e.g. a longer ALPN string from a future config source), the loop overflows alpns.
Suggested fix:
while (alpn) {
if (count >= (int)(sizeof(alpns) / sizeof(alpns[0])))
break; /* or log + fail */
...
}Happy to send a patch if contributions are accepted without an OCA; otherwise please consider this a report.
quic_session_set_alpns()parsesalpn_datainto a fixed-size stack array without checkingcountagainst the array capacity:Today this is safe only by a size coincidence:
conn->alpnsischar[128], so at most 64 single-character, comma-separated tokens fit (127 chars + NUL). But nothing enforces that relationship - ifTLSHD_QUIC_MAX_ALPNS_LENis ever raised, or the caller's buffer is filled differently (e.g. a longer ALPN string from a future config source), the loop overflowsalpns.Suggested fix:
Happy to send a patch if contributions are accepted without an OCA; otherwise please consider this a report.