Merge pull request from GHSA-qjfw-cvjf-f4fm

amphp · Apr 3, 2024 · 881cc33 · 881cc33
1 parent a19f480
commit 881cc33
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/src/Http2/Http2Parser.php b/src/Http2/Http2Parser.php
@@ -378,6 +378,15 @@ private function pushHeaderBlockFragment(int $streamId, string $buffer): void
         $this->headerStream = $streamId;
         $this->headerBuffer[] = $buffer;
         $this->headerLength += \strlen($buffer);
+
+        $headersTooLarge = $this->headerLength > $this->headerSizeLimit;
+
+        if ($headersTooLarge) {
+            throw new Http2ConnectionException(
+                "Headers exceed the maximum configured size of {$this->headerSizeLimit} bytes",
+                self::COMPRESSION_ERROR
+            );
+        }
     }
 
     /** @see https://http2.github.io/http2-spec/#HEADERS */