Mercurial > hg > nginx-quic

comparison src/event/ngx_event_quic_transport.c @ 7721:556b34a863b2 quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fixed buffer overrun in create_transport_params() with -24. It writes 16-bit prefix as designed, but length calculation assumed varint.
author Sergey Kandaurov <pluknet@nginx.com>
date Sat, 21 Mar 2020 19:22:39 +0300
parents 856d5a2de258
children 0a18893299fe
comparison
equal deleted inserted replaced
7720:856d5a2de258 7721:556b34a863b2
1134 len += ngx_quic_tp_len(NGX_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI, 1134 len += ngx_quic_tp_len(NGX_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI,
1135 tp->initial_max_stream_data_uni); 1135 tp->initial_max_stream_data_uni);
1136 1136
1137 if (pos == NULL) { 1137 if (pos == NULL) {
1138 #if (quic_version < 0xff00001b) 1138 #if (quic_version < 0xff00001b)
1139 len += ngx_quic_varint_len(len); 1139 len += 2;
1140 #endif 1140 #endif
1141 return len; 1141 return len;
1142 } 1142 }
1143 1143
1144 #if (quic_version < 0xff00001b) 1144 #if (quic_version < 0xff00001b)