Merge pull request #286 from ngtcp2/deny-new-server-bidi-stream

Explicitly deny new server-initiated bidirectional stream
ngtcp2 · Dec 29, 2024 · 87bb001 · 87bb001
2 parents 444f491 + d35c8f8
commit 87bb001
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/lib/nghttp3_conn.c b/lib/nghttp3_conn.c
@@ -434,6 +434,10 @@ nghttp3_ssize nghttp3_conn_read_stream(nghttp3_conn *conn, int64_t stream_id,
             return rv;
           }
         }
+      } else if(!nghttp3_stream_uni(stream_id)) {
+        /* server does not expect to receive new server initiated
+           bidirectional stream from client. */
+        return NGHTTP3_ERR_H3_STREAM_CREATION_ERROR;
       } else {
         /* unidirectional stream */
         if (srclen == 0 && fin) {