CVE-2026-43972

@@ -781,38 +781,60 @@ rst_stream_frame(State0, StreamID, Reason, EvHandler, EvHandlerState0) ->
 push_promise_frame(State=#http2_state{socket=Socket, transport=Transport,
 		status=Status, http2_machine=HTTP2Machine0},
 		StreamID, PromisedStreamID, Headers, #{
-			method := Method, scheme := Scheme,
-			authority := Authority, path := Path},
+			method := PromisedMethod, scheme := PromisedScheme,
+			authority := PromisedAuthority, path := PromisedPath},
 		EvHandler, EvHandlerState0) ->
-	#stream{ref=StreamRef, reply_to=ReplyTo, flow=InitialFlow} = get_stream_by_id(State, StreamID),
+	#stream{
+		ref=StreamRef,
+		authority=Authority,
+		reply_to=ReplyTo,
+		flow=InitialFlow
+	} = get_stream_by_id(State, StreamID),
+	Scheme = scheme(State),
+	%% We cancel the push_promise immediately when we are shutting
+	%% down or when the scheme/authority doesn't match the request's.
+	%% @todo We may wish to extend valid authorities to those that
+	%%       are covered by the server's TLS certificate.
+	OKOrError = case Status of
+		connected ->
+			case {Scheme, iolist_to_binary(Authority)} of
+				{PromisedScheme, PromisedAuthority} -> ok;
+				_ -> protocol_error
+			end;
+		_ ->
+			cancel
+	end,
 	PromisedStreamRef = make_ref(),
 	RealPromisedStreamRef = stream_ref(State, PromisedStreamRef),
-	URI = iolist_to_binary([Scheme, <<"://">>, Authority, Path]),
+	URI = iolist_to_binary([PromisedScheme, <<"://">>, PromisedAuthority, PromisedPath]),
 	PushPromiseEvent0 = #{
 		stream_ref => stream_ref(State, StreamRef),
 		reply_to => ReplyTo,
-		method => Method,
+		method => PromisedMethod,
 		uri => URI,
 		headers => Headers
 	},
-	PushPromiseEvent = case Status of
-		connected ->
+	PushPromiseEvent = case OKOrError of
+		ok ->
 			gun:reply(ReplyTo, {gun_push, self(), stream_ref(State, StreamRef),
-				RealPromisedStreamRef, Method, URI, Headers}),
+				RealPromisedStreamRef, PromisedMethod, URI, Headers}),
 			PushPromiseEvent0#{promised_stream_ref => RealPromisedStreamRef};
 		_ ->
 			PushPromiseEvent0
 	end,
 	EvHandlerState = EvHandler:push_promise_end(PushPromiseEvent, EvHandlerState0),
-	case Status of
-		connected ->
-			NewStream = #stream{id=PromisedStreamID, ref=PromisedStreamRef,
-				reply_to=ReplyTo, flow=InitialFlow, authority=Authority, path=Path},
+	case OKOrError of
+		ok ->
+			NewStream = #stream{
+				id=PromisedStreamID, ref=PromisedStreamRef,
+				reply_to=ReplyTo, flow=InitialFlow,
+				authority=PromisedAuthority, path=PromisedPath
+			},
 			{{state, create_stream(State, NewStream)}, EvHandlerState};
-		%% We cancel the push_promise immediately when we are shutting down.
+		%% Invalid push_promise gets canceled immediately.
 		_ ->
 			{ok, HTTP2Machine} = cow_http2_machine:reset_stream(PromisedStreamID, HTTP2Machine0),
-			case Transport:send(Socket, cow_http2:rst_stream(PromisedStreamID, cancel)) of
+			case Transport:send(Socket, cow_http2:rst_stream(PromisedStreamID, OKOrError)) of
 				ok ->
 					{{state, State#http2_state{http2_machine=HTTP2Machine}}, EvHandlerState};
 				Error={error, _} ->

@@ -555,6 +555,42 @@ do_ping_ack_loop_fun() ->
 		Loop(Parent, ListenSocket, Socket, Transport)
 	end.
 
+push_promise_invalid_authority(_) ->
+	doc("An authority in PUSH_PROMISE for which the server is not "
+		"authoritative must be rejected with a PROTOCOL_ERROR "
+		"stream error. (RFC7540 8.2, RFC9113 8.4)"),
+	{ok, OriginPid, Port} = init_origin(tcp, http2, fun(Parent, _, Socket, Transport) ->
+		%% Receive a HEADERS frame.
+		{ok, <<SkipLen:24, 1:8, _:8, 1:32>>} = Transport:recv(Socket, 9, 1000),
+		%% Skip the header.
+		{ok, _} = gen_tcp:recv(Socket, SkipLen, 1000),
+		%% Send a PUSH_PROMISE frame.
+		{HeadersBlock, _} = cow_hpack:encode([
+			{<<":method">>, <<"GET">>},
+			{<<":scheme">>, <<"http">>},
+			{<<":authority">>, <<"gun.test">>},
+			{<<":path">>, <<"/">>}
+		]),
+		ok = Transport:send(Socket, [
+			cow_http2:push_promise(1, 2, HeadersBlock)
+		]),
+		%% Receive a PROTOCOL_ERROR RST_STREAM for pushed stream.
+		{ok, << 4:24, 3:8, 2:40, 1:32 >>} = gen_tcp:recv(Socket, 13, 1000),
+		Parent ! done,
+		timer:sleep(5000)
+	end),
+	{ok, ConnPid} = gun:open("localhost", Port, #{
+		protocols => [http2]
+	}),
+	{ok, http2} = gun:await_up(ConnPid),
+	handshake_completed = receive_from(OriginPid),
+	%% Step 1.
+	StreamRef = gun:get(ConnPid, "/"),
+	%% Confirm we never get the gun_push message.
+	{error, timeout} = gun:await(ConnPid, StreamRef, 1000),
+	receive done -> ok end,
+	gun:close(ConnPid).
+
 connect_http_via_h2c(_) ->
 	doc("CONNECT can be used to establish a TCP connection "
 		"to an HTTP/1.1 server via a TCP HTTP/2 proxy. (RFC7540 8.3)"),