HTTP/2: fixed overlapping memcpy in CONTINUATION frames
Some checks are pending
buildbot / buildbot (push) Waiting to run

When processing CONTINUATION frames, ngx_http_v2_handle_continuation()
used ngx_memcpy() to shift header block fragment data past the frame
header.  If the fragment is larger than the frame header (9 bytes),
the source and destination regions overlap, which is undefined
behavior for memcpy.  The same function already uses ngx_memmove()
for another overlapping shift.
This commit is contained in:
Feng Wu 2026-06-21 17:30:29 +08:00 committed by Andrew Clayton
parent be84ac8bda
commit 2d71bdcf8b

View file

@ -1967,7 +1967,7 @@ ngx_http_v2_handle_continuation(ngx_http_v2_connection_t *h2c, u_char *pos,
p = pos;
pos += NGX_HTTP_V2_FRAME_HEADER_SIZE;
ngx_memcpy(pos, p, len);
ngx_memmove(pos, p, len);
len = ngx_http_v2_parse_length(head);