mirror of
https://github.com/nginx/nginx.git
synced 2024-11-27 15:39:01 +08:00
HTTP/3: fixed dynamic table overflow.
While inserting a new entry into the dynamic table, first the entry is added, and then older entries are evicted until table size is within capacity. After the first step, the number of entries may temporarily exceed the maximum calculated from capacity by one entry, which previously caused table overflow. The easiest way to trigger the issue is to keep adding entries with empty names and values until first eviction. The issue was introduced by 987bee4363d1.
This commit is contained in:
parent
0fd59c8b56
commit
cca5655dd9
@ -308,7 +308,7 @@ ngx_http_v3_set_capacity(ngx_connection_t *c, ngx_uint_t capacity)
|
||||
prev_max = dt->capacity / 32;
|
||||
|
||||
if (max > prev_max) {
|
||||
elts = ngx_alloc(max * sizeof(void *), c->log);
|
||||
elts = ngx_alloc((max + 1) * sizeof(void *), c->log);
|
||||
if (elts == NULL) {
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user