]> git.kaiwu.me - nginx.git/commitdiff
HTTP/3: avoid undefined behaviour with empty encoder field values
authordgprivate <dean.gostisa@black.si>
Sat, 29 Aug 2026 05:53:38 +0000 (05:53 +0000)
committerSergey Kandaurov <pluknet@nginx.com>
Thu, 15 Oct 2026 15:00:47 +0000 (19:00 +0400)
A zero length field value in encoder stream instructions left the value
data pointer NULL, passed then to ngx_memcpy() in ngx_http_v3_insert().
For the reasons outlined in b0a4d0fb8, it is now set to an empty string.

src/http/v3/ngx_http_v3_parse.c

index 573a832ef22ec60ff55f64c389f9192d4a1906ca..0a985e10b6c55386d2b19b1af2943b4951ac24eb 100644 (file)
@@ -1543,7 +1543,7 @@ ngx_http_v3_parse_field_inr(ngx_connection_t *c,
 
             st->literal.length = st->pint.value;
             if (st->literal.length == 0) {
-                st->value.len = 0;
+                ngx_str_set(&st->value, "");
                 goto done;
             }
 
@@ -1667,7 +1667,7 @@ ngx_http_v3_parse_field_iln(ngx_connection_t *c,
 
             st->literal.length = st->pint.value;
             if (st->literal.length == 0) {
-                st->value.len = 0;
+                ngx_str_set(&st->value, "");
                 goto done;
             }