diff options
| author | Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com> | 2021-01-25 18:39:00 +0900 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2021-01-26 17:12:47 +0100 |
| commit | a1338d429748cc1a15e19e6e1f71b4f1467acca5 (patch) | |
| tree | e8452b4437972086091187112826b04ce7982e5a | |
| parent | ad1c7154b35cab245ae12ec124c0e7ab6dae3c95 (diff) | |
| download | curl-a1338d429748cc1a15e19e6e1f71b4f1467acca5.tar.gz | |
ngtcp2: Fix stack buffer overflow
Closes #6521
| -rw-r--r-- | lib/vquic/ngtcp2.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/lib/vquic/ngtcp2.c b/lib/vquic/ngtcp2.c index e87f8f4ba..f2fce76ff 100644 --- a/lib/vquic/ngtcp2.c +++ b/lib/vquic/ngtcp2.c @@ -1334,13 +1334,14 @@ static ssize_t cb_h3_readfunction(nghttp3_conn *conn, int64_t stream_id, nread = H3_SEND_SIZE - out->windex; memcpy(&out->buf[out->windex], stream->upload_mem, nread); - out->windex += nread; - out->used += nread; /* that's the chunk we return to nghttp3 */ vec[0].base = &out->buf[out->windex]; vec[0].len = nread; + out->windex += nread; + out->used += nread; + if(out->windex == H3_SEND_SIZE) out->windex = 0; /* wrap */ stream->upload_mem += nread; |