h2: Improve pseudo-header handling

bin/varnishd/http2/cache_http2_hpack.c

@@ -134,6 +134,15 @@ h2h_addhdr(struct h2h_decode *d, struct http *hp, char *b, size_t namelen,
 			n = HTTP_HDR_URL;
 			disallow_empty = 1;
 
+			// rfc7540,l,3060,3071
+			if ((len > 0 && *b != '/') ||
+			    (len > 1 && *(b+1) == '/')) {
+				VSLb(hp->vsl, SLT_BogoHeader,
+				    "Illegal :path pseudo-header %.*s",
+				    (int)len, b);
+				return (H2SE_PROTOCOL_ERROR);
+			}
+
 			/* Second field cannot contain LWS or CTL */
 			for (p = b, u = 0; u < len; p++, u++) {
 				if (vct_islws(*p) || vct_isctl(*p))

bin/varnishtest/tests/a02027.vtc

+varnishtest "Malformed :path handling"
+
+server s1 {
+} -start
+
+varnish v1 -vcl+backend {
+	sub vcl_recv {
+		return (synth(200));
+	}
+} -start
+varnish v1 -cliok "param.set feature +http2"
+
+client c1 {
+	stream 1 {
+		txreq -noadd -hdr ":authority" "foo.com" -hdr ":path" "foobar" -hdr ":scheme" "http" -hdr ":method" "GET"
+		rxrst
+		expect rst.err == PROTOCOL_ERROR
+	} -run
+
+} -run
+
+client c1 {
+	stream 1 {
+		txreq -noadd -hdr ":authority" "foo.com" -hdr ":path" "//foo" -hdr ":scheme" "http" -hdr ":method" "GET"
+		rxrst
+		expect rst.err == PROTOCOL_ERROR
+	} -run
+
+} -run