Change #282501

Comments

capsule: reject a capsule that can never be buffered
The decoder waited for the full advertised payload before checking that
it fits anywhere, so a peer advertising a length the receive queue can
never hold made cf_capsule_recv() return CURLE_AGAIN forever.

Check the destination buffer first and fail when the receive queue is
full and still short of the capsule. Also bound the length so that
offset + payload_len cannot wrap.

Add a unit3400 case for the full-queue rejection.

Closes #22998

Changed files

• lib/vquic/capsule.c
• tests/unit/unit3400.c