diff options
| author | Sergey Kandaurov <pluknet@nginx.com> | 2020-03-21 19:22:39 +0300 |
|---|---|---|
| committer | Sergey Kandaurov <pluknet@nginx.com> | 2020-03-21 19:22:39 +0300 |
| commit | 79e49c2a162dd777ff0ab16954d5ee7c58da56e8 (patch) | |
| tree | 21903529947c4f74cba540d6b2a9a0ddc1d098fe /src | |
| parent | 4764ef15902bc749356507fc01aa7503e17c81a8 (diff) | |
| download | nginx-79e49c2a162dd777ff0ab16954d5ee7c58da56e8.tar.gz nginx-79e49c2a162dd777ff0ab16954d5ee7c58da56e8.tar.bz2 | |
Fixed buffer overrun in create_transport_params() with -24.
It writes 16-bit prefix as designed, but length calculation assumed varint.
Diffstat (limited to 'src')
| -rw-r--r-- | src/event/ngx_event_quic_transport.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/event/ngx_event_quic_transport.c b/src/event/ngx_event_quic_transport.c index 577ad7d45..826af2bdd 100644 --- a/src/event/ngx_event_quic_transport.c +++ b/src/event/ngx_event_quic_transport.c @@ -1136,7 +1136,7 @@ ngx_quic_create_transport_params(u_char *pos, u_char *end, ngx_quic_tp_t *tp) if (pos == NULL) { #if (quic_version < 0xff00001b) - len += ngx_quic_varint_len(len); + len += 2; #endif return len; } |