WINDOW_UPDATE: fix length validation and increment value range

Author: Kriechi

HISTORY.rst

@@ -13,6 +13,8 @@ Release History
 - Fixed padding parsing for ``PushPromiseFrame``.
 - Fixed unchecked frame length for ``PriorityFrame``. It now correctly raises ``InvalidFrameError``.
 - Fixed promised stream id parsing for ``PushPromiseFrame``.
+- Fixed unchecked frame length for ``WindowUpdateFrame``. It now correctly raises ``InvalidFrameError``.
+- Fixed window increment value range validation. It must be 1 <= increment <= 2^31-1.
 
 **Other Changes**
 

hyperframe/frame.py

@@ -622,11 +622,22 @@ def serialize_body(self):
         return _STRUCT_L.pack(self.window_increment & 0x7FFFFFFF)
 
     def parse_body(self, data):
+        if len(data) > 4:
+            raise InvalidFrameError(
+                "WINDOW_UPDATE frame must have 4 byte length: got %s" %
+                len(data)
+            )
+
         try:
             self.window_increment = _STRUCT_L.unpack(data)[0]
         except struct.error:
             raise InvalidFrameError("Invalid WINDOW_UPDATE body")
 
+        if not 1 <= self.window_increment <= 2**31-1:
+            raise InvalidFrameError(
+                "WINDOW_UPDATE increment must be between 1 to 2^31-1"
+            )
+
         self.body_len = 4
 
 

test/test_frames.py

@@ -604,10 +604,19 @@ def test_windowupdate_frame_parses_properly(self):
 
     def test_short_windowupdate_frame_errors(self):
         s = b'\x00\x00\x04\x08\x00\x00\x00\x00\x00\x00\x00\x02'  # -1 byte
+        with pytest.raises(InvalidFrameError):
+            decode_frame(s)
 
+        s = b'\x00\x00\x05\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'
         with pytest.raises(InvalidFrameError):
             decode_frame(s)
 
+        with pytest.raises(InvalidFrameError):
+            decode_frame(WindowUpdateFrame(0).serialize())
+
+        with pytest.raises(InvalidFrameError):
+            decode_frame(WindowUpdateFrame(2**31).serialize())
+
 
 class TestHeadersFrame(object):
     def test_headers_frame_flags(self):