nginx.git/src/http/v3/ngx_http_v3_table.c, branch release-1.29.2 nginx HTTP/3: fixed dynamic table overflow. 2024-05-28T13:18:50+00:00 Roman Arutyunyan arut@nginx.com 2024-05-28T13:18:50+00:00 cca5655dd9ba349817946a0db14f8b1f633f700a While inserting a new entry into the dynamic table, first the entry is added, and then older entries are evicted until table size is within capacity. After the first step, the number of entries may temporarily exceed the maximum calculated from capacity by one entry, which previously caused table overflow. The easiest way to trigger the issue is to keep adding entries with empty names and values until first eviction. The issue was introduced by 987bee4363d1. 
While inserting a new entry into the dynamic table, first the entry is added,
and then older entries are evicted until table size is within capacity.  After
the first step, the number of entries may temporarily exceed the maximum
calculated from capacity by one entry, which previously caused table overflow.

The easiest way to trigger the issue is to keep adding entries with empty names
and values until first eviction.

The issue was introduced by 987bee4363d1.
HTTP/3: handled insertion reference to a going to be evicted entry. 2023-01-03T12:24:45+00:00 Roman Arutyunyan arut@nginx.com 2023-01-03T12:24:45+00:00 d04f45ac5bddb034ec8c5b0874a7358a991d1b77 As per RFC 9204, section 3.2.2, a new entry can reference an entry in the dynamic table that will be evicted when adding this new entry into the dynamic table. Previously, such inserts resulted in use-after-free since the old entry was evicted before the insertion (ticket #2431). Now it's evicted after the insertion. This change fixes Insert with Name Reference and Duplicate encoder instructions. 
As per RFC 9204, section 3.2.2, a new entry can reference an entry in the
dynamic table that will be evicted when adding this new entry into the dynamic
table.

Previously, such inserts resulted in use-after-free since the old entry was
evicted before the insertion (ticket #2431).  Now it's evicted after the
insertion.

This change fixes Insert with Name Reference and Duplicate encoder instructions.
HTTP/3: updated SETTINGS_MAX_FIELD_SECTION_SIZE name. 2022-06-08T12:19:01+00:00 Sergey Kandaurov pluknet@nginx.com 2022-06-08T12:19:01+00:00 854e41fec24e1f292ec5a951e7bfc9377afc0905 






HTTP/3: delayed Insert Count Increment instruction.
2022-01-27T09:20:47+00:00

Roman Arutyunyan
arut@nginx.com

2022-01-27T09:20:47+00:00

c1b172f1d67f806c84dc088ddc57ed76514e85dd

Sending the instruction is delayed until the end of the current event cycle.
Delaying the instruction is allowed by quic-qpack-21, section 2.2.2.3.
The goal is to reduce the amount of data sent back to client by accumulating
several inserts in one instruction and sometimes not sending the instruction at
all, if Section Acknowledgement was sent just before it.





Sending the instruction is delayed until the end of the current event cycle.
Delaying the instruction is allowed by quic-qpack-21, section 2.2.2.3.
The goal is to reduce the amount of data sent back to client by accumulating
several inserts in one instruction and sometimes not sending the instruction at
all, if Section Acknowledgement was sent just before it.







HTTP/3: renamed files.
2021-12-07T10:01:28+00:00

Roman Arutyunyan
arut@nginx.com

2021-12-07T10:01:28+00:00

d1bc1da950488d8d3114a06ca00346fa58848a2d

ngx_http_v3_tables.h and ngx_http_v3_tables.c are renamed to
ngx_http_v3_table.h and ngx_http_v3_table.c to better match HTTP/2 code.

ngx_http_v3_streams.h and ngx_http_v3_streams.c are renamed to
ngx_http_v3_uni.h and ngx_http_v3_uni.c to better match their content.





ngx_http_v3_tables.h and ngx_http_v3_tables.c are renamed to
ngx_http_v3_table.h and ngx_http_v3_table.c to better match HTTP/2 code.

ngx_http_v3_streams.h and ngx_http_v3_streams.c are renamed to
ngx_http_v3_uni.h and ngx_http_v3_uni.c to better match their content.