{"record":{"id":"558b983e292f92d0","repo":"cloudflare/quiche","slug":"the-provided-buffer-is-too-large-558b98","errorCode":null,"errorMessage":"The provided buffer is too large","messagePattern":"The provided buffer is too large","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"quiche/src/h3/ffi.rs","lineNumber":308,"sourceCode":"        quic_conn,\n        stream_id,\n        &headers,\n        is_trailer_section,\n        fin,\n    ) {\n        Ok(_) => 0,\n\n        Err(e) => e.to_c() as c_int,\n    }\n}\n\n#[no_mangle]\npub extern \"C\" fn quiche_h3_send_body(\n    conn: &mut h3::Connection, quic_conn: &mut Connection, stream_id: u64,\n    body: *const u8, body_len: size_t, fin: bool,\n) -> ssize_t {\n    if body_len > <ssize_t>::MAX as usize {\n        panic!(\"The provided buffer is too large\");\n    }\n\n    let body = unsafe { slice::from_raw_parts(body, body_len) };\n\n    match conn.send_body(quic_conn, stream_id, body, fin) {\n        Ok(v) => v as ssize_t,\n\n        Err(e) => e.to_c(),\n    }\n}\n\n#[no_mangle]\npub extern \"C\" fn quiche_h3_recv_body(\n    conn: &mut h3::Connection, quic_conn: &mut Connection, stream_id: u64,\n    out: *mut u8, out_len: size_t,\n) -> ssize_t {\n    if out_len > <ssize_t>::MAX as usize {\n        panic!(\"The provided buffer is too large\");","sourceCodeStart":290,"sourceCodeEnd":326,"githubUrl":"https://github.com/cloudflare/quiche/blob/9f96daa2c22a4468b0036fb0a0a3894eee6498b8/quiche/src/h3/ffi.rs#L290-L326","documentation":"Defensive size guard in the H3 FFI wrapper quiche_h3_send_body. body_len is size_t but bytes sent are returned as ssize_t; a body length above ssize_t::MAX cannot be represented in the return value, so the wrapper panics instead of returning an ambiguous value.","triggerScenarios":"Calling quiche_h3_send_body() with body_len > SSIZE_MAX (typically a negative C length cast to size_t).","commonSituations":"Sign/overflow errors in C HTTP/3 applications, untrusted body sizes, fuzzing of the h3 FFI boundary.","solutions":["Pass the actual body buffer length, <= SSIZE_MAX","Validate or chunk large bodies before sending","Fix signed-length bugs at the call site"],"exampleFix":"// before\nquiche_h3_send_body(h3, conn, id, body, (size_t)len, fin);\n// after\nif (len < 0 || (size_t)len > SSIZE_MAX) return -1;\nquiche_h3_send_body(h3, conn, id, body, (size_t)len, fin);","handlingStrategy":"validation","validationCode":"if (body_len < 0 || (size_t)body_len > SSIZE_MAX) return -1;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Send bodies in bounded chunks rather than one huge buffer","Validate body lengths from untrusted sources","Use size_t/ssize_t consistently in H3 C callers"],"tags":["ffi","panic","buffer-size","http3","c-interop"],"backgroundTag":"value-out-of-range","analyzedSha":"9f96daa2c22a4468b0036fb0a0a3894eee6498b8","analyzedAt":"2026-09-08T11:27:09.536Z","contentChangedAt":"2026-09-08T11:27:09.536Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}