From 1c54340e0aa65781f6cd4cc643f704826c47459a Mon Sep 17 00:00:00 2001 From: Roman Arutyunyan Date: Tue, 19 May 2020 15:41:41 +0300 Subject: HTTP/3: prevent array access by negative index for unknown streams. Currently there are no such streams, but the function ngx_http_v3_get_uni_stream() supports them. --- src/http/v3/ngx_http_v3_streams.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'src/http') diff --git a/src/http/v3/ngx_http_v3_streams.c b/src/http/v3/ngx_http_v3_streams.c index 165f21fdc..bd4583998 100644 --- a/src/http/v3/ngx_http_v3_streams.c +++ b/src/http/v3/ngx_http_v3_streams.c @@ -320,7 +320,9 @@ ngx_http_v3_get_uni_stream(ngx_connection_t *c, ngx_uint_t type) sc->read->handler = ngx_http_v3_uni_read_handler; sc->write->handler = ngx_http_v3_dummy_write_handler; - h3c->known_streams[index] = sc; + if (index >= 0) { + h3c->known_streams[index] = sc; + } n = (u_char *) ngx_http_v3_encode_varlen_int(buf, type) - buf; -- cgit