]> git.kaiwu.me - nginx.git/commitdiff
QUIC: fixed off-by-one in frame range handler.
authorVladimir Homutov <vl@nginx.com>
Thu, 18 Jun 2020 08:16:35 +0000 (11:16 +0300)
committerVladimir Homutov <vl@nginx.com>
Thu, 18 Jun 2020 08:16:35 +0000 (11:16 +0300)
The ctx->pnum is incremented after the packet is sent, thus pointing to the
next packet number, which should not be used in comparison.

src/event/ngx_event_quic.c

index ce07930d6c2d60bb7c7348e251a73b43d83e0e7b..562a215ea3f6b428a282bb78ca48988c3165dab4 100644 (file)
@@ -2262,7 +2262,7 @@ ngx_quic_handle_ack_frame_range(ngx_connection_t *c, ngx_quic_send_ctx_t *ctx,
 
     if (!found) {
 
-        if (max <= ctx->pnum) {
+        if (max < ctx->pnum) {
             /* duplicate ACK or ACK for non-ack-eliciting frame */
             return NGX_OK;
         }