From a785be76f62ef76683034b4df99e0f353bb58921 Mon Sep 17 00:00:00 2001
From: Valentin Bartenev <vbart@nginx.com>
Date: Wed, 30 Apr 2014 20:34:20 +0400
Subject: [PATCH] SPDY: added protection from overrun of the receive buffer.

---
 src/http/ngx_http_spdy.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
index e53e3aa9f..810d8d8f4 100644
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -1921,6 +1921,14 @@ ngx_http_spdy_state_complete(ngx_http_spdy_connection_t *sc, u_char *pos,
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
                    "spdy frame complete pos:%p end:%p", pos, end);
 
+    if (pos > end) {
+        ngx_log_error(NGX_LOG_ALERT, sc->connection->log, 0,
+                      "receive buffer overrun");
+
+        ngx_debug_point();
+        return ngx_http_spdy_state_internal_error(sc);
+    }
+
     sc->handler = ngx_http_spdy_state_head;
     sc->stream = NULL;