From: Sergey Kandaurov <pluknet@nginx.com>
Date: Thu, 6 Aug 2026 17:14:27 +0000 (+0400)
Subject: Fixed overflow detection in chunked parser
X-Git-Tag: release-1.31.4~11
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=e419e28c98378ecf4e373f0c660e6c03665efd62;p=nginx.git

Fixed overflow detection in chunked parser

This was broken in f405ef11f (1.29.4).

Reported by Matt Suiche, Tolmo Inc.
---

diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c
index e1328da04..e547d0fdb 100644
--- a/src/http/ngx_http_parse.c
+++ b/src/http/ngx_http_parse.c
@@ -2420,7 +2420,7 @@ data:
     ctx->state = state;
     b->pos = pos;
 
-    if (ctx->size > NGX_MAX_OFF_T_VALUE - 5) {
+    if (ctx->size > NGX_MAX_OFF_T_VALUE - 9) {
         goto invalid;
     }