diff options
| author | Sergey Kandaurov <pluknet@nginx.com> | 2024-05-28 17:17:19 +0400 |
|---|---|---|
| committer | Sergey Kandaurov <pluknet@nginx.com> | 2024-05-28 17:17:19 +0400 |
| commit | eaa6daa5f5d79c0e34aa1a08faef3c574e46d613 (patch) | |
| tree | 7936ab0bb772554b590cc905af2b2881e0b0cd48 | |
| parent | 75e3004902586f4120ddac4e3e00802a9024b79e (diff) | |
| download | nginx-eaa6daa5f5d79c0e34aa1a08faef3c574e46d613.tar.gz nginx-eaa6daa5f5d79c0e34aa1a08faef3c574e46d613.zip | |
QUIC: client transport parameter data length checking.
| -rw-r--r-- | src/event/quic/ngx_event_quic_transport.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/event/quic/ngx_event_quic_transport.c b/src/event/quic/ngx_event_quic_transport.c index 19670a6b1..fba098caa 100644 --- a/src/event/quic/ngx_event_quic_transport.c +++ b/src/event/quic/ngx_event_quic_transport.c @@ -1750,6 +1750,14 @@ ngx_quic_parse_transport_params(u_char *p, u_char *end, ngx_quic_tp_t *tp, return NGX_ERROR; } + if ((size_t) (end - p) < len) { + ngx_log_error(NGX_LOG_INFO, log, 0, + "quic failed to parse" + " transport param id:0x%xL, data length %uL too long", + id, len); + return NGX_ERROR; + } + rc = ngx_quic_parse_transport_param(p, p + len, id, tp); if (rc == NGX_ERROR) { |