CERBERUS/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-08-04 14:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge 176a1278f0 into 4b90ec7692

Browse source
This commit is contained in:
David CARLIER 2026-08-03 05:55:32 +00:00 • committed by GitHub
commit 3946992d8d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/http/v3/ngx_http_v3_parse.c
View file

@ -437,6 +437,12 @@ ngx_http_v3_parse_field_section_prefix(ngx_connection_t *c,
return rc;
}
if (st->pint.value > (ngx_uint_t) -1) {
ngx_log_error(NGX_LOG_INFO, c->log, 0,
"client sent too large insert count");
return NGX_HTTP_V3_ERR_DECOMPRESSION_FAILED;
}
st->insert_count = st->pint.value;
st->state = sw_delta_base;
break;
@ -461,6 +467,12 @@ ngx_http_v3_parse_field_section_prefix(ngx_connection_t *c,
return rc;
}
if (st->pint.value > (ngx_uint_t) -1) {
ngx_log_error(NGX_LOG_INFO, c->log, 0,
"client sent too large delta base");
return NGX_HTTP_V3_ERR_DECOMPRESSION_FAILED;
}
st->delta_base = st->pint.value;
goto done;
}
@ -482,6 +494,11 @@ done:
st->base = st->insert_count - st->delta_base - 1;
} else {
if (st->delta_base > (ngx_uint_t) -1 - st->insert_count) {
ngx_log_error(NGX_LOG_INFO, c->log, 0, "client sent too large base");
return NGX_HTTP_V3_ERR_DECOMPRESSION_FAILED;
}
st->base = st->insert_count + st->delta_base;
}