Kestrel's ParseHeaders throws an ArgumentOutOfRange exception on certain headers

[WereWind1]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I have been fuzzing some of the Kestrel methods and ran into a part where in crashes on certain multi-span headers. The issue seems to be in the fact that on multispan headers where one section ends with cr kestrel tries to see if there is data after cr inside the whole header (there is) and then when it rejects the header it tries to grab extra data from the specific span it inspects (and there is no data) so it throws

Expected Behavior

ParseHeaders module cleanly rejects the problematic header without exceptions

Steps To Reproduce

https://github.com/WereWind1/KestrelHttpParserExceptionMinimal

Exceptions (if any)

ArgumentOutOfRange

.NET Version

6.0.36 8.0.14 9.0.3

Anything else?

No response

[BrennanConroy]

Looks like

aspnetcore/src/Servers/Kestrel/Core/src/Internal/Http/HttpParser.cs

Lines 252 to 254 in 9c67617

	// Include the thing after the CR in the rejection exception.
	var stopIndex = crIndex + 2;
	RejectRequestHeader(span[..stopIndex]);

assumes the data was in a single span.

Would you be interested in contributing a fix?
We'd also want to improve test coverage, new test likely would go in https://github.com/dotnet/aspnetcore/blob/main/src/Servers/Kestrel/Core/test/HttpParserTests.cs

[WereWind1]

Yes, I would like to do so. I just have a question if I can submit the fix into the 6.0 version as well as in the later ones? I can't seem to find the branch for this one

[BrennanConroy]

6.0 is out of support, so definitely no.

[dotnet-policy-service]

Looks like this issue has been identified as a candidate for community contribution. If you're considering sending a PR for this issue, look for the Summary Comment link in the issue description. That comment has been left by an engineer on our team to help you get started with handling this issue. You can learn more about our Help Wanted process here