From 6611698b90464d395ee6715b910682d83f1101c1 Mon Sep 17 00:00:00 2001 From: Dmitry Volyntsev Date: Mon, 21 Sep 2026 20:28:29 -0700 Subject: [PATCH] CHB: avoid overflow when enforcing the chain limit Check the requested size against the remaining chain capacity instead of adding it to the current total. This prevents the size check from wrapping and bypassing the configured chain limit. --- src/njs_chb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/njs_chb.c b/src/njs_chb.c index eace09fe..ece3aeb0 100644 --- a/src/njs_chb.c +++ b/src/njs_chb.c @@ -68,7 +68,8 @@ njs_chb_reserve(njs_chb_t *chain, size_t size) } if (njs_slow_path(chain->max_size != 0 - && chain->total_size + size > chain->max_size)) + && (chain->total_size > chain->max_size + || size > chain->max_size - chain->total_size))) { chain->error = NJS_CHB_ERR_OVERFLOW; return NULL; -- 2.47.3