Fix out of bound array access in decode_length

2013-10-18 19:30:04 +09:00 · 2013-10-18 19:30:04 +09:00 · 7bd145fd23
parent f7389ff2e6
commit 7bd145fd23
1 changed files with 1 additions and 1 deletions
--- a/lib/nghttp2_hd.c
+++ b/lib/nghttp2_hd.c
@ -438,7 +438,7 @@ static  uint8_t* decode_length(ssize_t *res, uint8_t *in, uint8_t *last,
      break;
    }
  }
-  if(*in & (1 << 7)) {
+  if(in == last || *in & (1 << 7)) {
    *res = -1;
    return NULL;
  } else {