Merge pull request from GHSA-qjfw-cvjf-f4fm

amphp · Apr 3, 2024 · 3a33e68 · 3a33e68
1 parent 68c61d2
commit 3a33e68
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/src/Http2/Http2Parser.php b/src/Http2/Http2Parser.php
@@ -407,6 +407,15 @@ private function pushHeaderBlockFragment(int $streamId, string $buffer): void
 
         $this->headerStream = $streamId;
         $this->headerBuffer .= $buffer;
+
+        $headersTooLarge = \strlen($this->headerBuffer) > $this->headerSizeLimit;
+
+        if ($headersTooLarge) {
+            throw new Http2ConnectionException(
+                "Headers exceed the maximum configured size of {$this->headerSizeLimit} bytes",
+                self::COMPRESSION_ERROR
+            );
+        }
     }
 
     /** @see https://http2.github.io/http2-spec/#HEADERS */