From: dgprivate <dean.gostisa@black.si>
Date: Sat, 29 Aug 2026 05:53:38 +0000 (+0000)
Subject: HTTP/3: avoid undefined behaviour with empty encoder field values
X-Git-Tag: release-1.31.8~19
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=35a437d3d9e930401227cd5b214b7cffb02687d3;p=nginx.git

HTTP/3: avoid undefined behaviour with empty encoder field values

A zero length field value in encoder stream instructions left the value
data pointer NULL, passed then to ngx_memcpy() in ngx_http_v3_insert().
For the reasons outlined in b0a4d0fb8, it is now set to an empty string.
---

diff --git a/src/http/v3/ngx_http_v3_parse.c b/src/http/v3/ngx_http_v3_parse.c
index 573a832ef..0a985e10b 100644
--- a/src/http/v3/ngx_http_v3_parse.c
+++ b/src/http/v3/ngx_http_v3_parse.c
@@ -1543,7 +1543,7 @@ ngx_http_v3_parse_field_inr(ngx_connection_t *c,
 
             st->literal.length = st->pint.value;
             if (st->literal.length == 0) {
-                st->value.len = 0;
+                ngx_str_set(&st->value, "");
                 goto done;
             }
 
@@ -1667,7 +1667,7 @@ ngx_http_v3_parse_field_iln(ngx_connection_t *c,
 
             st->literal.length = st->pint.value;
             if (st->literal.length == 0) {
-                st->value.len = 0;
+                ngx_str_set(&st->value, "");
                 goto done;
             }