Mercurial > hg > nginx
changeset 5696:19a14a484707
SPDY: added protection from overrun of the receive buffer.
| author | Valentin Bartenev <vbart@nginx.com> |
|---|---|
| date | Wed, 30 Apr 2014 20:34:20 +0400 |
| parents | 231588611230 |
| children | c985d90a8d1f |
| files | src/http/ngx_http_spdy.c |
| diffstat | 1 files changed, 8 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/src/http/ngx_http_spdy.c +++ b/src/http/ngx_http_spdy.c @@ -1921,6 +1921,14 @@ ngx_http_spdy_state_complete(ngx_http_sp ngx_log_debug2(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0, "spdy frame complete pos:%p end:%p", pos, end); + if (pos > end) { + ngx_log_error(NGX_LOG_ALERT, sc->connection->log, 0, + "receive buffer overrun"); + + ngx_debug_point(); + return ngx_http_spdy_state_internal_error(sc); + } + sc->handler = ngx_http_spdy_state_head; sc->stream = NULL;