fix(quic support): Wipe buffers after reading post-handshake message#5750
Merged
WesleyRosenblum merged 7 commits intomainfrom Feb 20, 2026
Merged
fix(quic support): Wipe buffers after reading post-handshake message#5750WesleyRosenblum merged 7 commits intomainfrom
WesleyRosenblum merged 7 commits intomainfrom
Conversation
Loading
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Goal
Succeed when reading more than one post-handshake message in our quic support API.
We would like to thank Joshua Rogers (https://joshua.hu/) of AISLE Research Team (https://aisle.com/) for reporting this issue.
Why
s2n_recv_quic_post_handshake_message will fail if you ever call it twice in a row. Each time you call that API, the header read cursor is reset to 0. This is to handle the case where the message happens to be fragmented and we block, the next time we call the API, we can now reparse the header to get the expected message length. However if you read two messages in a row, you will reread the old header again, which leads to a parsing error.
We never hit this bug in s2n-quic as we never read more than one session ticket message. But we should fix it since we might one day need to process more than one post-handshake message.
How
Wipes the header and message buffers after successfully reading a post-handshake message in our quic support API.
Callouts
Testing
Includes unit test.
Related
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.