[webpatser]

Http2Driver advertises $headerSizeLimit (32 KiB by default) as SETTINGS_MAX_HEADER_LIST_SIZE, but it creates its Http2Parser without that limit, so the parser falls back to its own 16 KiB default. A client that trusts the advertised value and sends a header block between 16 and 32 KiB gets a COMPRESSION_ERROR GOAWAY. A smaller configured limit is also not applied: the parser keeps accepting up to 16 KiB.

This came out of the fixes I made in my fork (webpatser/fledge-fiber), sending them back as offered. Small one, easy wave to catch.

Summary

• Http2Driver::processClientInput() passes $this->headerSizeLimit to Http2Parser, so the enforced and advertised limits agree.
• The headerSizeLimit parameter exists in Http2Parser since amphp/http v2.0.0, so no constraint change is needed.

Reproduce

Send a request over HTTP/2 with a single 20,000-byte (hard to compress) header value to a server with default settings. It is refused with GOAWAY COMPRESSION_ERROR although the server advertised 32768.

Test plan

• testAcceptsHeadersUpToTheDefaultHeaderSizeLimit: a 20,000-byte header is accepted with the default limit.
• testEnforcesTheConfiguredHeaderSizeLimit: with headerSizeLimit: 4096, SETTINGS advertises 4096 and an 8,000-byte header gets GOAWAY COMPRESSION_ERROR without reaching the request handler.
• Both tests fail on 3.x without the change and pass with it; the full suite passes.

[trowski]

Thank you very much @webpatser! Keep those PRs coming! 😄