mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-06-07 17:52:38 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

SPDY: fixed check for too long header name or value.

Browse Source 
For further progress a new buffer must be at least two bytes larger than
the remaining unparsed data.  One more byte is needed for null-termination
and another one for further progress.  Otherwise inflate() fails with
Z_BUF_ERROR.
This commit is contained in:
Valentin Bartenev 2014-11-07 17:22:19 +03:00
parent 42b6d57fb5
commit 20d41493d4
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/http/ngx_http_spdy.c
View File

@ -2660,10 +2660,10 @@ ngx_http_spdy_alloc_large_header_buffer(ngx_http_request_t *r)
rest = r->header_in->last - r->header_in->pos; rest = r->header_in->last - r->header_in->pos;
/* /*
* equality is prohibited since one more byte is needed * One more byte is needed for null-termination
* for null-termination * and another one for further progress.
*/ */
if (rest >= cscf->large_client_header_buffers.size) { if (rest > cscf->large_client_header_buffers.size - 2) {
p = r->header_in->pos; p = r->header_in->pos;
if (rest > NGX_MAX_ERROR_STR - 300) { if (rest > NGX_MAX_ERROR_STR - 300) {