On Thu, Jan 8, 2026 at 9:45 AM Paolo Abeni [off-list ref] wrote:

On 1/5/26 3:04 PM, Xin Long wrote:

quoted

+/* Check whether 'd2' is equal to any element inside the list 'd1'.
+ *
+ * 'd1' is assumed to be a sequence of length-prefixed elements. Each element
+ * is compared to 'd2' using 'quic_data_cmp()'.
+ *
+ * Returns 1 if a match is found, 0 otherwise.
+ */
+int quic_data_has(struct quic_data *d1, struct quic_data *d2)
+{
+     struct quic_data d;
+     u64 length;
+     u32 len;
+     u8 *p;
+
+     for (p = d1->data, len = d1->len; len; len -= length, p += length) {
+             quic_get_int(&p, &len, &length, 1);
+             quic_data(&d, p, length);
+             if (!quic_data_cmp(&d, d2))
+                     return 1;

AI review found something likely relevant here:

"""
Can this cause an integer underflow?  When 'length' (read from the data)
is greater than the remaining 'len', the subtraction 'len -= length' will
wrap the u32 to a very large value, causing out-of-bounds memory access.

Compare with quic_data_to_string() which validates: 'len < length'.

The same issue exists in quic_data_match() below.
"""

AI seems right. I will change it to:

                if (!quic_get_int(&p, &len, &length, 1) || len < length)
                        return 0;

Thanks.