Mercurial > hg > nginx

changeset 8255:556b34a863b2 quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fixed buffer overrun in create_transport_params() with -24. It writes 16-bit prefix as designed, but length calculation assumed varint.
author Sergey Kandaurov <pluknet@nginx.com>
date Sat, 21 Mar 2020 19:22:39 +0300
parents 856d5a2de258
children 0a18893299fe
files src/event/ngx_event_quic_transport.c
diffstat 1 files changed, 1 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/src/event/ngx_event_quic_transport.c
+++ b/src/event/ngx_event_quic_transport.c
@@ -1136,7 +1136,7 @@ ngx_quic_create_transport_params(u_char 
 
     if (pos == NULL) {
 #if (quic_version < 0xff00001b)
-        len += ngx_quic_varint_len(len);
+        len += 2;
 #endif
         return len;
     }