From 6929aebe31a9337eb38b25d0d56c5854a9a4734f Mon Sep 17 00:00:00 2001 From: Sergey Kandaurov Date: Thu, 5 Sep 2024 19:35:43 +0400 Subject: [PATCH] HTTP/3: fixed potential type overflow in string literal parser. This might happen for Huffman encoded string literals as the result of length expansion. Notably, the maximum length of string literals is already limited with the "large_client_header_buffers" directive, so this was only possible with very large configured limits. --- src/http/v3/ngx_http_v3_parse.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/http/v3/ngx_http_v3_parse.c b/src/http/v3/ngx_http_v3_parse.c index 436765c8a..bcbf0dbe1 100644 --- a/src/http/v3/ngx_http_v3_parse.c +++ b/src/http/v3/ngx_http_v3_parse.c @@ -623,6 +623,12 @@ ngx_http_v3_parse_literal(ngx_connection_t *c, ngx_http_v3_parse_literal_t *st, } if (st->huffman) { + if (n > NGX_MAX_INT_T_VALUE / 8) { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent too large field line"); + return NGX_HTTP_V3_ERR_EXCESSIVE_LOAD; + } + n = n * 8 / 5; st->huffstate = 0; }