GHSA-cw8r-2jj2-w8fw: NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame

The HTTP/2 server in subsys/net/lib/http/httpserverhttp2.c clears the connection's stream binding at the start of every frame. handlehttpframeheader() executed client->currentstream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enterhttpframecontinuationstate() never re-bound one, so the rest of the header block was processed with client->currentstream unset. Two paths then write through the NULL pointer. A request for an unregistered resource, or a method the matched resource does not support, is answered by sendhttp2404() or sendhttp2405(), and both call sendheadersframe(), which unconditionally sets client->currentstream->headerssent = true. A POST, PUT or PATCH to a registered dynamic resource reaches handlehttp2dynamicresource(), which unlike its siblings (handlehttp2staticresource(), dynamicgetdeloptsreqv2(), dynamicpostputreqv2()) had no client->currentstream == NULL guard, and stores through the pointer with client->currentstream->currentdetail = dynamicdetail.

Any peer that can reach the server can trigger this without authentication or prior state. A single stray CONTINUATION frame with ENDHEADERS set, sent right after the client preface and requesting any unregistered path, is enough, because nothing rejected a CONTINUATION that no HEADERS frame had opened. A legitimate split header block (a HEADERS frame with ENDHEADERS clear whose payload ends on a header-field boundary, then a CONTINUATION with ENDHEADERS set) reaches the same state. The in-tree test testhttp2postheaderswithcontinuation() did not catch this because it splits the header block mid field, which takes the handleincompletehttpheader() shortcut that keeps the stream bound.

The result is a write to a fixed low address (a small offset into struct http2streamctx), which faults on mainstream targets (flash/vector-table region on Cortex-M, or a trap under MPU/MMU null-pointer detection), and the default fatal-error handler halts the system. Impact is an unauthenticated, remotely triggerable denial of service against any device running the HTTP/2 server: the 404 path needs no particular resource to be registered, and HTTP/2 is built into CONFIGHTTPSERVER with cleartext h2c accepted, so TLS does not prevent it. Neither the target address nor the written value is attacker-controlled, so there is no confidentiality or integrity impact. Applications built without CONFIGHTTPSERVER are not affected.