From a213258b5beb8d83a0907eed00fe402d67610303 Mon Sep 17 00:00:00 2001
From: Vladimir Homutov <vl@nginx.com>
Date: Thu, 18 Jun 2020 11:16:35 +0300
Subject: [PATCH] QUIC: fixed off-by-one in frame range handler.

The ctx->pnum is incremented after the packet is sent, thus pointing to the
next packet number, which should not be used in comparison.
---
 src/event/ngx_event_quic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/event/ngx_event_quic.c b/src/event/ngx_event_quic.c
index ce07930d6..562a215ea 100644
--- a/src/event/ngx_event_quic.c
+++ b/src/event/ngx_event_quic.c
@@ -2262,7 +2262,7 @@ ngx_quic_handle_ack_frame_range(ngx_connection_t *c, ngx_quic_send_ctx_t *ctx,
 
     if (!found) {
 
-        if (max <= ctx->pnum) {
+        if (max < ctx->pnum) {
             /* duplicate ACK or ACK for non-ack-eliciting frame */
             return NGX_OK;
         }