HTTP/3: prevent array access by negative index for unknown streams.

Currently there are no such streams, but the function
ngx_http_v3_get_uni_stream() supports them.

diff --git a/src/http/v3/ngx_http_v3_streams.c b/src/http/v3/ngx_http_v3_streams.c
index 165f21fdc8c2914d84217be446ab3d706a0b556e..bd4583998e377013d72308dea5ea4324684e59aa 100644 (file)
--- a/src/http/v3/ngx_http_v3_streams.c
+++ b/src/http/v3/ngx_http_v3_streams.c
@@ -320,7 +320,9 @@ ngx_http_v3_get_uni_stream(ngx_connection_t *c, ngx_uint_t type)
     sc->read->handler = ngx_http_v3_uni_read_handler;
     sc->write->handler = ngx_http_v3_dummy_write_handler;
 
-    h3c->known_streams[index] = sc;
+    if (index >= 0) {
+        h3c->known_streams[index] = sc;
+    }
 
     n = (u_char *) ngx_http_v3_encode_varlen_int(buf, type) - buf;