tree 64f7d295e584013793009d316b42f085eecec2b7
parent 85e122b1a9b37a3b0cb26ee9ca1c2e5b521f1969
author Damien Neil <dneil@google.com> 1638829903 -0800
committer Filippo Valsorda <filippo@golang.org> 1639044509 -0500

[internal-branch.go1.17-vendor] http2: cap the size of the server's canonical header cache

The HTTP/2 server keeps a per-connection cache mapping header keys
to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the
maximum size of this cache to prevent a peer sending many unique
header keys from causing unbounded memory growth.

Cap chosen arbitrarily at 32 entries. Since this cache does not
include common headers (e.g., "content-type"), 32 seems like more
than enough for almost all normal uses.

Updates golang/go#50058
Fixes CVE-2021-44716

Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827
Reviewed-by: Roland Shoemaker <bracewell@google.com>