Mercurial > hg > nginx

changeset 9018:5b1011b5702b quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
HTTP/3: require that field section base index is not negative. RFC 9204 explicitly requires that.
author Roman Arutyunyan <arut@nginx.com>
date Thu, 26 May 2022 16:17:56 +0400
parents c2f5d79cde64
children 0e74a77c2475
files src/http/v3/ngx_http_v3_parse.c
diffstat 1 files changed, 6 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/src/http/v3/ngx_http_v3_parse.c
+++ b/src/http/v3/ngx_http_v3_parse.c
@@ -474,7 +474,13 @@ done:
     }
 
     if (st->sign) {
+        if (st->insert_count <= st->delta_base) {
+            ngx_log_error(NGX_LOG_INFO, c->log, 0, "client sent negative base");
+            return NGX_HTTP_V3_ERR_DECOMPRESSION_FAILED;
+        }
+
         st->base = st->insert_count - st->delta_base - 1;
+
     } else {
         st->base = st->insert_count + st->delta_base;
     }