Mercurial > hg > nginx

comparison src/event/quic/ngx_event_quic_streams.c @ 8841:1f7f98638dc2 quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
QUIC: fixed null pointer dereference in MAX_DATA handler. If a MAX_DATA frame was received before any stream was created, then the worker process would crash in nginx_quic_handle_max_data_frame() while traversing the stream tree. The issue is solved by adding a check that makes sure the tree is not empty.
author Mariano Di Martino <mariano.dimartino@uhasselt.be>
date Fri, 03 Sep 2021 14:23:50 +0300
parents a9f6540e61da
children 486c6a9be111
comparison
equal deleted inserted replaced
8840:4d871baeacd2 8841:1f7f98638dc2
998 998
999 if (f->max_data <= qc->streams.send_max_data) { 999 if (f->max_data <= qc->streams.send_max_data) {
1000 return NGX_OK; 1000 return NGX_OK;
1001 } 1001 }
1002 1002
1003 if (qc->streams.sent >= qc->streams.send_max_data) { 1003 if (tree->root != tree->sentinel
1004 && qc->streams.sent >= qc->streams.send_max_data)
1005 {
1004 1006
1005 for (node = ngx_rbtree_min(tree->root, tree->sentinel); 1007 for (node = ngx_rbtree_min(tree->root, tree->sentinel);
1006 node; 1008 node;
1007 node = ngx_rbtree_next(tree, node)) 1009 node = ngx_rbtree_next(tree, node))
1008 { 1010 {