Mercurial > hg > nginx
comparison src/http/v3/ngx_http_v3_parse.c @ 8649:5a92523e50d3 quic
HTTP/3: null-terminate empty header value.
Header value returned from the HTTP parser is expected to be null-terminated or
have a spare byte after the value bytes. When an empty header value was passed
by client in a literal header representation, neither was true. This could
result in segfault. The fix is to assign a literal empty null-terminated
string in this case.
Thanks to Andrey Kolyshkin.
| author | Roman Arutyunyan <arut@nginx.com> |
|---|---|
| date | Tue, 17 Nov 2020 20:54:10 +0000 |
| parents | 279ad36f2f4b |
| children | ab6aaa8e86b0 |
comparison
equal
deleted
inserted
replaced
| 8648:b80d9179ba2a | 8649:5a92523e50d3 |
|---|---|
| 744 return rc; | 744 return rc; |
| 745 } | 745 } |
| 746 | 746 |
| 747 st->literal.length = st->pint.value; | 747 st->literal.length = st->pint.value; |
| 748 if (st->literal.length == 0) { | 748 if (st->literal.length == 0) { |
| 749 st->value.data = (u_char *) ""; | |
| 749 goto done; | 750 goto done; |
| 750 } | 751 } |
| 751 | 752 |
| 752 st->state = sw_value; | 753 st->state = sw_value; |
| 753 break; | 754 break; |