@@ -55,6 +55,7 @@ SRC_URI += "\
file://CVE-2023-45290.patch \
file://CVE-2024-24784.patch \
file://CVE-2024-24785.patch \
+ file://CVE-2023-45288.patch \
"
SRC_URI[main.sha256sum] = "a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784ada0cd300fd"
new file mode 100644
@@ -0,0 +1,95 @@
+From e55d7cf8435ba4e58d4a5694e63b391821d4ee9b Mon Sep 17 00:00:00 2001
+From: Damien Neil <dneil@google.com>
+Date: Thu, 28 Mar 2024 16:57:51 -0700
+Subject: [PATCH] [release-branch.go1.22] net/http: update bundled
+ golang.org/x/net/http2
+
+Disable cmd/internal/moddeps test, since this update includes PRIVATE
+track fixes.
+
+Fixes CVE-2023-45288
+For #65051
+Fixes #66298
+
+Change-Id: I5bbf774ebe7651e4bb7e55139d3794bd2b8e8fa8
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2197227
+Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
+Run-TryBot: Damien Neil <dneil@google.com>
+Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/576076
+Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
+TryBot-Bypass: Dmitri Shuralyov <dmitshur@google.com>
+Reviewed-by: Than McIntosh <thanm@google.com>
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/e55d7cf8435ba4e58d4a5694e63b391821d4ee9b]
+CVE: CVE-2023-45288
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ src/cmd/internal/moddeps/moddeps_test.go | 1 +
+ src/net/http/h2_bundle.go | 31 ++++++++++++++++++++++++
+ 2 files changed, 32 insertions(+)
+
+diff --git a/src/cmd/internal/moddeps/moddeps_test.go b/src/cmd/internal/moddeps/moddeps_test.go
+index d48d43f..250bde4 100644
+--- a/src/cmd/internal/moddeps/moddeps_test.go
++++ b/src/cmd/internal/moddeps/moddeps_test.go
+@@ -34,6 +34,7 @@ import (
+ // See issues 36852, 41409, and 43687.
+ // (Also see golang.org/issue/27348.)
+ func TestAllDependencies(t *testing.T) {
++ t.Skip("TODO(#65051): 1.22.2 contains unreleased changes from vendored modules")
+ t.Skip("TODO(#57009): 1.19.4 contains unreleased changes from vendored modules")
+ t.Skip("TODO(#53977): 1.18.5 contains unreleased changes from vendored modules")
+
+diff --git a/src/net/http/h2_bundle.go b/src/net/http/h2_bundle.go
+index 9d6abd8..10ff193 100644
+--- a/src/net/http/h2_bundle.go
++++ b/src/net/http/h2_bundle.go
+@@ -2842,6 +2842,7 @@ func (fr *http2Framer) readMetaFrame(hf *http2HeadersFrame) (*http2MetaHeadersFr
+ if size > remainSize {
+ hdec.SetEmitEnabled(false)
+ mh.Truncated = true
++ remainSize = 0
+ return
+ }
+ remainSize -= size
+@@ -2854,6 +2855,36 @@ func (fr *http2Framer) readMetaFrame(hf *http2HeadersFrame) (*http2MetaHeadersFr
+ var hc http2headersOrContinuation = hf
+ for {
+ frag := hc.HeaderBlockFragment()
++
++ // Avoid parsing large amounts of headers that we will then discard.
++ // If the sender exceeds the max header list size by too much,
++ // skip parsing the fragment and close the connection.
++ //
++ // "Too much" is either any CONTINUATION frame after we've already
++ // exceeded the max header list size (in which case remainSize is 0),
++ // or a frame whose encoded size is more than twice the remaining
++ // header list bytes we're willing to accept.
++ if int64(len(frag)) > int64(2*remainSize) {
++ if http2VerboseLogs {
++ log.Printf("http2: header list too large")
++ }
++ // It would be nice to send a RST_STREAM before sending the GOAWAY,
++ // but the struture of the server's frame writer makes this difficult.
++ return nil, http2ConnectionError(http2ErrCodeProtocol)
++ }
++
++ // Also close the connection after any CONTINUATION frame following an
++ // invalid header, since we stop tracking the size of the headers after
++ // an invalid one.
++ if invalid != nil {
++ if http2VerboseLogs {
++ log.Printf("http2: invalid header: %v", invalid)
++ }
++ // It would be nice to send a RST_STREAM before sending the GOAWAY,
++ // but the struture of the server's frame writer makes this difficult.
++ return nil, http2ConnectionError(http2ErrCodeProtocol)
++ }
++
+ if _, err := hdec.Write(frag); err != nil {
+ return nil, http2ConnectionError(http2ErrCodeCompression)
+ }
+--
+2.25.1
+