CHB: avoid overflow when enforcing the chain limit

Check the requested size against the remaining chain capacity instead of
adding it to the current total.  This prevents the size check from wrapping
and bypassing the configured chain limit.

diff --git a/src/njs_chb.c b/src/njs_chb.c
index eace09fe7ef5baeb381467a2bb5ad73d67847f23..ece3aeb0ffea6b0e2bd4a774d0438aa4d3d3a563 100644 (file)
--- a/src/njs_chb.c
+++ b/src/njs_chb.c
@@ -68,7 +68,8 @@ njs_chb_reserve(njs_chb_t *chain, size_t size)
     }
 
     if (njs_slow_path(chain->max_size != 0
-                      && chain->total_size + size > chain->max_size))
+                      && (chain->total_size > chain->max_size
+                          || size > chain->max_size - chain->total_size)))
     {
         chain->error = NJS_CHB_ERR_OVERFLOW;
         return NULL;