Fixed overflow detection in chunked parser

This was broken in f405ef11f (1.29.4).

Reported by Matt Suiche, Tolmo Inc.

diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c
index 81f689e5bdd5bcddb52c336049f68ed9039a580f..ceb138079c7d6b3b3009b2dd3b46fdd78930a5bc 100644 (file)
--- a/src/http/ngx_http_parse.c
+++ b/src/http/ngx_http_parse.c
@@ -2404,7 +2404,7 @@ data:
     ctx->state = state;
     b->pos = pos;
 
-    if (ctx->size > NGX_MAX_OFF_T_VALUE - 5) {
+    if (ctx->size > NGX_MAX_OFF_T_VALUE - 9) {
         goto invalid;
     }