elixir-mint / hpax / 7719986de1c4ac1cc9dfe30159dc6cacd8fc8f00-PR-26

96%

main: 96%

Pull #26

github

Raise a catchable error on malformed Huffman-coded input

HPAX.Huffman.decode/1 only handled two "end of input" cases: an
exhausted binary, and 1-7 leftover bits that form valid EOS padding.
Any input that leaves 8 or more trailing bits which don't correspond
to a complete Huffman code - which can only happen with a malformed
or malicious encoding, since a real encoder never produces such
output - matched no clause at all, raising an unhandled
FunctionClauseError instead of the {:hpax, _} throw that callers of
HPAX.decode/2 already know how to handle gracefully.

A peer can trigger this by sending a HEADERS frame with a
deliberately invalid Huffman-coded string value, crashing the
decoding process instead of the connection being cleanly failed per
RFC 7541.

1 of 1 new or added line in 1 file covered. (100.0%)

163 of 170 relevant lines covered (95.88%)

8347.84 hits per line