diff options
Diffstat (limited to 'src/event/ngx_event_quic_transport.c')
| -rw-r--r-- | src/event/ngx_event_quic_transport.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/src/event/ngx_event_quic_transport.c b/src/event/ngx_event_quic_transport.c index 1732f8b0f..5d0182032 100644 --- a/src/event/ngx_event_quic_transport.c +++ b/src/event/ngx_event_quic_transport.c @@ -283,6 +283,12 @@ ngx_quic_parse_long_header(ngx_quic_header_t *pkt) return NGX_ERROR; } + if (idlen > NGX_QUIC_CID_LEN_MAX) { + ngx_log_error(NGX_LOG_INFO, pkt->log, 0, + "quic packet dcid is too long"); + return NGX_ERROR; + } + pkt->dcid.len = idlen; p = ngx_quic_read_bytes(p, end, idlen, &pkt->dcid.data); @@ -299,6 +305,12 @@ ngx_quic_parse_long_header(ngx_quic_header_t *pkt) return NGX_ERROR; } + if (idlen > NGX_QUIC_CID_LEN_MAX) { + ngx_log_error(NGX_LOG_INFO, pkt->log, 0, + "quic packet scid is too long"); + return NGX_ERROR; + } + pkt->scid.len = idlen; p = ngx_quic_read_bytes(p, end, idlen, &pkt->scid.data); |