Bound buffered frames by their declared length, before reading the payload

examples/server.rs

@@ -112,7 +112,9 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                 Ok(conn) => {
                     info!("new connection established");
 
-                    let mut h3_conn = h3::server::Connection::new(h3_quinn::Connection::new(conn))
+                    let mut h3_conn = h3::server::builder()
+                        .max_field_section_size(1024 * 16)
+                        .build(h3_quinn::Connection::new(conn))
                         .await
                         .unwrap();
 

h3/src/client/connection.rs

@@ -216,7 +216,11 @@ where
 
         let request_stream = RequestStream {
             inner: connection::RequestStream::new(
-                FrameStream::new(BufRecvStream::new(stream)),
+                FrameStream::new_with_max_buffered_frame(
+                    BufRecvStream::new(stream),
+                    self.max_field_section_size
+                        .max(crate::frame::DEFAULT_MAX_BUFFERED_FRAME),
+                ),
                 self.max_field_section_size,
                 self.conn_state.clone(),
                 self.send_grease_frame,

h3/src/client/stream.rs

@@ -12,6 +12,7 @@ use crate::{
         internal_error::InternalConnectionError,
         Code, StreamError,
     },
+    frame::FrameStreamError,
     proto::{frame::Frame, headers::Header},
     qpack,
     quic::{self},
@@ -97,8 +98,17 @@ where
     /// [`recv_data()`]: #method.recv_data
     #[cfg_attr(feature = "tracing", instrument(skip_all, level = "trace"))]
     pub async fn recv_response(&mut self) -> Result<Response<()>, StreamError> {
-        let mut frame = future::poll_fn(|cx| self.inner.stream.poll_next(cx))
-            .await
+        let frame = future::poll_fn(|cx| self.inner.stream.poll_next(cx)).await;
+        if matches!(
+            frame,
+            Err(FrameStreamError::PayloadTooLarge {
+                frame_type: 0x1,
+                ..
+            })
+        ) {
+            self.inner.stop_sending(Code::H3_REQUEST_CANCELLED);
+        }
+        let mut frame = frame
             .map_err(|e| self.handle_frame_stream_error_on_request_stream(e))?
             .ok_or_else(|| {
                 //= https://www.rfc-editor.org/rfc/rfc9114#section-4.1

h3/src/connection.rs

@@ -565,6 +565,22 @@ where
                     ),
                 )));
             }
+            Err(FrameStreamError::PayloadTooLarge {
+                frame_type: _ty,
+                actual_size: _actual,
+                max_size: _max,
+            }) => {
+                // Unlike a request stream, there is no message to reject here:
+                // every frame the control stream may legitimately carry is tens
+                // of bytes, and the stream itself is critical.
+                return Poll::Ready(Err(self.handle_connection_error(
+                    InternalConnectionError::new(
+                        Code::H3_EXCESSIVE_LOAD,
+                        "control frame declared a payload larger than this endpoint will buffer"
+                            .to_string(),
+                    ),
+                )));
+            }
             Err(FrameStreamError::Proto(frame_error)) => {
                 return Poll::Ready(Err(self.handle_connection_error(
                     InternalConnectionError::got_frame_error(frame_error),
@@ -858,9 +874,18 @@ where
         if !self.stream.has_data() {
             match ready!(self.stream.poll_next(cx)) {
                 Err(frame_stream_error) => {
+                    if matches!(
+                        frame_stream_error,
+                        FrameStreamError::PayloadTooLarge {
+                            frame_type: 0x1,
+                            ..
+                        }
+                    ) {
+                        self.stream.stop_sending(Code::H3_REQUEST_CANCELLED);
+                    }
                     return Poll::Ready(Err(
                         self.handle_frame_stream_error_on_request_stream(frame_stream_error)
-                    ))
+                    ));
                 }
                 Ok(None) => return Poll::Ready(Ok(None)),
                 Ok(Some(Frame::Headers(encoded))) => {
@@ -919,9 +944,18 @@ where
         } else {
             match ready!(self.stream.poll_next(cx)) {
                 Err(frame_stream_error) => {
+                    if matches!(
+                        frame_stream_error,
+                        FrameStreamError::PayloadTooLarge {
+                            frame_type: 0x1,
+                            ..
+                        }
+                    ) {
+                        self.stream.stop_sending(Code::H3_REQUEST_CANCELLED);
+                    }
                     return Poll::Ready(Err(
                         self.handle_frame_stream_error_on_request_stream(frame_stream_error)
-                    ))
+                    ));
                 }
                 Ok(None) => return Poll::Ready(Ok(None)),
                 Ok(Some(Frame::Headers(encoded))) => encoded,
@@ -967,9 +1001,18 @@ where
 
             match self.stream.poll_next(cx) {
                 Poll::Ready(Err(frame_stream_error)) => {
+                    if matches!(
+                        frame_stream_error,
+                        FrameStreamError::PayloadTooLarge {
+                            frame_type: 0x1,
+                            ..
+                        }
+                    ) {
+                        self.stream.stop_sending(Code::H3_REQUEST_CANCELLED);
+                    }
                     return Poll::Ready(Err(
                         self.handle_frame_stream_error_on_request_stream(frame_stream_error)
-                    ))
+                    ));
                 }
                 Poll::Ready(Ok(Some(trailing_frame))) => {
                     // Received a known frame after trailers -> fail.

h3/src/error/connection_error_creators.rs

@@ -197,6 +197,22 @@ where
             FrameStreamError::Proto(frame_error) => self.handle_connection_error_on_stream(
                 InternalConnectionError::got_frame_error(frame_error),
             ),
+            // A HEADERS limit is per message: rejecting one request must not
+            // close unrelated streams on the same connection.
+            FrameStreamError::PayloadTooLarge {
+                frame_type: 0x1,
+                actual_size,
+                max_size,
+            } => StreamError::HeaderTooBig {
+                actual_size,
+                max_size,
+            },
+            FrameStreamError::PayloadTooLarge { .. } => {
+                self.handle_connection_error_on_stream(InternalConnectionError::new(
+                    Code::H3_EXCESSIVE_LOAD,
+                    "frame declared a payload larger than this endpoint will buffer".to_string(),
+                ))
+            }
             FrameStreamError::UnexpectedEnd => {
                 self.handle_connection_error_on_stream(InternalConnectionError::new(
                     Code::H3_FRAME_ERROR,