Infinite loop in Alt-Svc header parser in hackney

@@ -225,12 +225,25 @@ is_h3_protocol(_) -> false.
 parse_entries(<<>>, Acc) ->
     lists:reverse(Acc);
 parse_entries(Data, Acc) ->
-    {Entry, Rest} = parse_entry(skip_ws(Data)),
+    Stripped = skip_ws(Data),
+    {Entry, Rest} = parse_entry(Stripped),
+    %% GHSA-6cp8: ensure forward progress. A leading non-token byte
+    %% (`!`, `@`, `=`, `;`, `.`, ...) makes parse_entry return
+    %% {undefined, Rest=Stripped}, which would otherwise loop forever.
+    %% Skip to the next ',' so at most one malformed entry is dropped.
+    Rest1 = case Entry of
+                undefined when Rest =:= Stripped -> seek_next_entry(Stripped);
+                _ -> Rest
+            end,
     case Entry of
-        undefined -> parse_entries(skip_comma(Rest), Acc);
-        _ -> parse_entries(skip_comma(Rest), [Entry | Acc])
+        undefined -> parse_entries(skip_comma(Rest1), Acc);
+        _ -> parse_entries(skip_comma(Rest1), [Entry | Acc])
     end.
 
+seek_next_entry(<<>>) -> <<>>;
+seek_next_entry(<<$,, _/binary>> = Data) -> Data;
+seek_next_entry(<<_, Rest/binary>>) -> seek_next_entry(Rest).
+
 %% Parse a single Alt-Svc entry: protocol="host:port"; ma=N
 parse_entry(<<>>) ->
     {undefined, <<>>};

@@ -40,7 +40,9 @@ parse_test_() ->
                 {"parse h3 with ma parameter", fun test_parse_h3_ma/0},
                 {"parse multiple entries", fun test_parse_multiple/0},
                 {"parse clear", fun test_parse_clear/0},
-                {"parse h3-29 variant", fun test_parse_h3_variant/0}
+                {"parse h3-29 variant", fun test_parse_h3_variant/0},
+                {"GHSA-6cp8: non-token lead byte terminates",
+                 fun test_parse_non_token_lead_byte/0}
             ]
         }
     }.
@@ -65,6 +67,15 @@ test_parse_h3_variant() ->
     Result = hackney_altsvc:parse(<<"h3-29=\":443\"">>),
     ?assertEqual([{h3, same, 443, 86400}], Result).
 
+%% GHSA-6cp8: a leading non-token byte used to spin parse_entries/2 forever.
+%% The parser must terminate, and must still recover entries that follow a
+%% malformed one.
+test_parse_non_token_lead_byte() ->
+    [?assertEqual([], hackney_altsvc:parse(B))
+     || B <- [<<"!">>, <<"@">>, <<"=">>, <<";">>, <<".">>]],
+    ?assertEqual([{h3, same, 443, 86400}],
+                 hackney_altsvc:parse(<<"!, h3=\":443\"">>)).
+
 %%====================================================================
 %% Cache Tests
 %%====================================================================