Mercurial > hg > nginx
comparison src/event/ngx_event_quic_transport.c @ 8255:556b34a863b2 quic
Fixed buffer overrun in create_transport_params() with -24.
It writes 16-bit prefix as designed, but length calculation assumed varint.
author | Sergey Kandaurov <pluknet@nginx.com> |
---|---|
date | Sat, 21 Mar 2020 19:22:39 +0300 |
parents | 856d5a2de258 |
children | 0a18893299fe |
comparison
equal
deleted
inserted
replaced
8254:856d5a2de258 | 8255:556b34a863b2 |
---|---|
1134 len += ngx_quic_tp_len(NGX_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI, | 1134 len += ngx_quic_tp_len(NGX_QUIC_TP_INITIAL_MAX_STREAM_DATA_UNI, |
1135 tp->initial_max_stream_data_uni); | 1135 tp->initial_max_stream_data_uni); |
1136 | 1136 |
1137 if (pos == NULL) { | 1137 if (pos == NULL) { |
1138 #if (quic_version < 0xff00001b) | 1138 #if (quic_version < 0xff00001b) |
1139 len += ngx_quic_varint_len(len); | 1139 len += 2; |
1140 #endif | 1140 #endif |
1141 return len; | 1141 return len; |
1142 } | 1142 } |
1143 | 1143 |
1144 #if (quic_version < 0xff00001b) | 1144 #if (quic_version < 0xff00001b) |