Skip to content

Correct handling of unsigned HTTP/2 SETTINGS values - #713

Merged
arturobernalg merged 1 commit into
apache:masterfrom
arturobernalg:h2-unsigned-settings
Oct 5, 2026
Merged

arturobernalg merged 1 commit into
apache:masterfrom
arturobernalg:h2-unsigned-settings

Conversation

@arturobernalg

Copy link
Copy Markdown
Member

RFC 9113 defines SETTINGS values as unsigned 32-bit integers. Values with the high bit set are currently read as negative Java int values and rejected for SETTINGS_HEADER_TABLE_SIZE, SETTINGS_MAX_CONCURRENT_STREAMS, and SETTINGS_MAX_HEADER_LIST_SIZE.

Accept the full unsigned wire range for these settings and bound values above Integer.MAX_VALUE to the internal H2Config representation.

SETTINGS_INITIAL_WINDOW_SIZE is intentionally unchanged: values above 2^31-1 continue to produce FLOW_CONTROL_ERROR. SETTINGS_MAX_FRAME_SIZE also retains its RFC-defined range.

RFC 9113 §2.2, §6.5.1 and §6.5.2.

@arturobernalg
arturobernalg force-pushed the h2-unsigned-settings branch 2 times, most recently from a358e5b to c79252c Compare October 2, 2026 13:58
@arturobernalg
arturobernalg requested a review from ok2c October 2, 2026 13:58
@ok2c

ok2c commented Oct 2, 2026

Copy link
Copy Markdown
Member

@arturobernalg I am honestly not sure I understand the problem you are trying to solve here. What is the problem with the setting value being represented by signed int? What is important that for any kind of arithmetic operations it need to be converted to long with Integer#toUnsignedLong

@arturobernalg

Copy link
Copy Markdown
Member Author

@arturobernalg I am honestly not sure I understand the problem you are trying to solve here. What is the problem with the setting value being represented by signed int? What is important that for any kind of arithmetic operations it need to be converted to long with Integer#toUnsignedLong

@ok2c I conflated the signed representation with the unsigned interpretation; I’ll keep the raw 32-bit value as int and only use Integer.toUnsignedLong where numeric comparison or arithmetic is required.

@arturobernalg
arturobernalg requested a review from ok2c October 5, 2026 07:58

@ok2c ok2c left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@arturobernalg Exactly! Looks good now.
Please cherry-pick to 5.4.x

@arturobernalg
arturobernalg merged commit d6b7790 into apache:master Oct 5, 2026
12 checks passed
@arturobernalg

Copy link
Copy Markdown
Member Author

@arturobernalg Exactly! Looks good now. Please cherry-pick to 5.4.x

@ok2c done

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants