Fixed overflow detection in chunked parser

This was broken in f405ef11f (1.29.4).

Reported by Matt Suiche, Tolmo Inc.

diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c
index e1328da049e66d82491a1df467df3a6c62e107b8..e547d0fdb8f450b4817cc8cb24005dd65061b570 100644 (file)
--- a/src/http/ngx_http_parse.c
+++ b/src/http/ngx_http_parse.c
@@ -2420,7 +2420,7 @@ data:
     ctx->state = state;
     b->pos = pos;
 
-    if (ctx->size > NGX_MAX_OFF_T_VALUE - 5) {
+    if (ctx->size > NGX_MAX_OFF_T_VALUE - 9) {
         goto invalid;
     }