From e66d71d8156500a2d719f97a66fd26f08889aa66 Mon Sep 17 00:00:00 2001
From: Benjamin Saunders <ben.e.saunders@gmail.com>
Date: Wed, 17 Oct 2018 22:18:38 -0700
Subject: [PATCH] Fix panics on invalid transport parameters

---
 quinn-proto/src/connection.rs           | 18 +++++++++++++-----
 quinn-proto/src/transport_parameters.rs | 11 ++++++++++-
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/quinn-proto/src/connection.rs b/quinn-proto/src/connection.rs
index fca8de9f6..5fac53b91 100644
--- a/quinn-proto/src/connection.rs
+++ b/quinn-proto/src/connection.rs
@@ -18,7 +18,7 @@ use packet::{
 };
 use range_set::RangeSet;
 use stream::{self, Stream};
-use transport_parameters::TransportParameters;
+use transport_parameters::{self, TransportParameters};
 use {
     frame, Directionality, Frame, Side, StreamId, TransportError, MIN_INITIAL_SIZE, MIN_MTU,
     VERSION,
@@ -890,7 +890,7 @@ impl Connection {
         now: u64,
         packet_number: u64,
         payload: Bytes,
-    ) -> Result<(), TLSError> {
+    ) -> Result<(), TransportError> {
         let frame = if let Ok(Some(frame)) = parse_initial(&ctx.log, payload) {
             frame
         } else {
@@ -907,11 +907,13 @@ impl Connection {
         };
         let mut tls = TlsSession::new_server(&ctx.config.tls_server_config, &server_params);
         self.read_tls(&mut tls, &frame);
-        tls.process_new_packets()?;
+        if tls.process_new_packets().is_err() {
+            return Err(TransportError::TLS_HANDSHAKE_FAILED);
+        }
         let params = TransportParameters::read(
             Side::Server,
             &mut io::Cursor::new(tls.get_quic_transport_parameters().unwrap()),
-        ).unwrap();
+        )?;
         self.handshake_complete(ctx, tls, params, now, packet_number);
         Ok(())
     }
@@ -1088,7 +1090,7 @@ impl Connection {
                                     let params = TransportParameters::read(
                                         self.side,
                                         &mut io::Cursor::new(params),
-                                    ).unwrap();
+                                    )?;
                                     self.set_params(params);
                                 } else {
                                     debug!(ctx.log, "remote didn't send transport params");
@@ -2437,6 +2439,12 @@ impl From<state::CloseReason> for ConnectionError {
     }
 }
 
+impl From<transport_parameters::Error> for ConnectionError {
+    fn from(e: transport_parameters::Error) -> Self {
+        TransportError::from(e).into()
+    }
+}
+
 #[derive(Debug, Fail, Clone, Eq, PartialEq, Ord, PartialOrd, Hash)]
 pub enum ReadError {
     /// No more data is currently available on this stream.
diff --git a/quinn-proto/src/transport_parameters.rs b/quinn-proto/src/transport_parameters.rs
index 6f92a33b6..f99faa8f4 100644
--- a/quinn-proto/src/transport_parameters.rs
+++ b/quinn-proto/src/transport_parameters.rs
@@ -2,7 +2,7 @@ use bytes::{Buf, BufMut};
 
 use coding::{BufExt, BufMutExt};
 use endpoint::Config;
-use {Side, VERSION};
+use {Side, TransportError, VERSION};
 
 #[derive(Debug, Copy, Clone, Eq, PartialEq)]
 pub struct TransportParameters {
@@ -56,6 +56,15 @@ pub enum Error {
     Malformed,
 }
 
+impl From<Error> for TransportError {
+    fn from(e: Error) -> Self {
+        match e {
+            Error::VersionNegotiation => TransportError::VERSION_NEGOTIATION_ERROR,
+            Error::IllegalValue | Error::Malformed => TransportError::TRANSPORT_PARAMETER_ERROR,
+        }
+    }
+}
+
 impl TransportParameters {
     pub fn write<W: BufMut>(&self, side: Side, w: &mut W) {
         if side == Side::Server {