From: Sergey Kandaurov <pluknet@nginx.com>
Date: Thu, 27 May 2021 10:29:00 +0000 (+0300)
Subject: HTTP/3: fixed Insert With Name Reference index processing.
X-Git-Tag: release-1.25.0~4^2~324
X-Git-Url: http://git.kaiwu.me/postgresql/log/contrib/postgres_fdw/postgres_fdw.c?a=commitdiff_plain;h=03fcff287db0d6b620f837de95116ad3a3b7e1e9;p=nginx.git

HTTP/3: fixed Insert With Name Reference index processing.

Based on a patch by Zhiyong Sun.
---

diff --git a/src/http/v3/ngx_http_v3_tables.c b/src/http/v3/ngx_http_v3_tables.c
index e07332c96..8f4e28edd 100644
--- a/src/http/v3/ngx_http_v3_tables.c
+++ b/src/http/v3/ngx_http_v3_tables.c
@@ -159,12 +159,23 @@ ngx_int_t
 ngx_http_v3_ref_insert(ngx_connection_t *c, ngx_uint_t dynamic,
     ngx_uint_t index, ngx_str_t *value)
 {
-    ngx_str_t  name;
+    ngx_str_t                     name;
+    ngx_http_v3_session_t        *h3c;
+    ngx_http_v3_dynamic_table_t  *dt;
 
     if (dynamic) {
         ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
                        "http3 ref insert dynamic[%ui] \"%V\"", index, value);
 
+        h3c = ngx_http_v3_get_session(c);
+        dt = &h3c->table;
+
+        if (dt->base + dt->nelts <= index) {
+            return NGX_HTTP_V3_ERR_ENCODER_STREAM_ERROR;
+        }
+
+        index = dt->base + dt->nelts - 1 - index;
+
         if (ngx_http_v3_lookup(c, index, &name, NULL) != NGX_OK) {
             return NGX_HTTP_V3_ERR_ENCODER_STREAM_ERROR;
         }