mirror of
https://github.com/nginx/nginx.git
synced 2026-08-04 14:58:20 +00:00
HTTP/2: fixed overlapping memcpy in CONTINUATION frames
Some checks are pending
buildbot / buildbot (push) Waiting to run
Some checks are pending
buildbot / buildbot (push) Waiting to run
When processing CONTINUATION frames, ngx_http_v2_handle_continuation() used ngx_memcpy() to shift header block fragment data past the frame header. If the fragment is larger than the frame header (9 bytes), the source and destination regions overlap, which is undefined behavior for memcpy. The same function already uses ngx_memmove() for another overlapping shift.
This commit is contained in:
parent
be84ac8bda
commit
2d71bdcf8b
1 changed files with 1 additions and 1 deletions
|
|
@ -1967,7 +1967,7 @@ ngx_http_v2_handle_continuation(ngx_http_v2_connection_t *h2c, u_char *pos,
|
|||
p = pos;
|
||||
pos += NGX_HTTP_V2_FRAME_HEADER_SIZE;
|
||||
|
||||
ngx_memcpy(pos, p, len);
|
||||
ngx_memmove(pos, p, len);
|
||||
|
||||
len = ngx_http_v2_parse_length(head);
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue