walkero
/
nghttp2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

nghttp2_hd: Fail inflate immediately if ctx.bad is nonzero 

Doing inflation after error produces invalid results, especially, if
it is in NGHTTP2_HD_STATE_READ_INDEX, the inflater->left could be 0,
which causes assertion error.  Add sanity assertion for index
This commit is contained in:
Tatsuhiro Tsujikawa 2014-02-26 23:20:52 +09:00
parent b3f6664bc6
commit 2f23eac179
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/nghttp2_hd.c
View File

@ -1412,6 +1412,10 @@ ssize_t nghttp2_hd_inflate_hd(nghttp2_hd_inflater *inflater,
uint8_t *last = in + inlen; uint8_t *last = in + inlen;
int rfin = 0; int rfin = 0;
if(inflater->ctx.bad) {
return NGHTTP2_ERR_HEADER_COMP;
}
DEBUGF(fprintf(stderr, "nghtp2_hd_infalte_hd start state=%d\n", DEBUGF(fprintf(stderr, "nghtp2_hd_infalte_hd start state=%d\n",
inflater->state)); inflater->state));
hd_inflate_keep_free(inflater); hd_inflate_keep_free(inflater);
@ -1477,6 +1481,7 @@ ssize_t nghttp2_hd_inflate_hd(nghttp2_hd_inflater *inflater,
} }
} else { } else {
inflater->index = inflater->left; inflater->index = inflater->left;
assert(inflater->index > 0);
--inflater->index; --inflater->index;
inflater->ent_name = nghttp2_hd_table_get(&inflater->ctx, inflater->ent_name = nghttp2_hd_table_get(&inflater->ctx,
inflater->index); inflater->index);