From 21e14737271c250c2060b1459e135af08946b5f3 Mon Sep 17 00:00:00 2001 From: Santhosha Bandahalli Kumara Date: Mon, 7 Sep 2026 23:59:55 +0530 Subject: [PATCH] Prevent out-of-bounds header protection sample reads --- src/core/connection.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/src/core/connection.c b/src/core/connection.c index 1b56f6b89f..2ae83b8099 100644 --- a/src/core/connection.c +++ b/src/core/connection.c @@ -4086,10 +4086,18 @@ QuicConnRecvHeader( // don't actually know the length of the packet number so we assume maximum // (per spec) and start sampling 4 bytes after the start of the packet number. // - CxPlatCopyMemory( - Cipher, - Packet->AvailBuffer + Packet->HeaderLength + 4, - CXPLAT_HP_SAMPLE_LENGTH); + if (Packet->Encrypted && Connection->State.HeaderProtectionEnabled) { + CxPlatCopyMemory( + Cipher, + Packet->AvailBuffer + Packet->HeaderLength + 4, + CXPLAT_HP_SAMPLE_LENGTH); + } else { + // + // For unencrypted short header packets, no header protection mask will be computed, + // so avoid reading an HP sample that may extend beyond the packet. + // + CxPlatZeroMemory(Cipher, CXPLAT_HP_SAMPLE_LENGTH); + } return TRUE; }