walkero
/
nghttp2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

nghttpx: Fix stack buffer overflow with API call

This commit is contained in:
Tatsuhiro Tsujikawa 2016-06-15 22:45:40 +09:00
parent 57259481c8
commit 92572203e7
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/shrpx_api_downstream_connection.cc
View File

@ -192,8 +192,8 @@ int APIDownstreamConnection::end_upload_data() {
auto output = downstream_->get_request_buf(); auto output = downstream_->get_request_buf();
struct iovec iov; std::array<struct iovec, 2> iov;
auto iovcnt = output->riovec(&iov, 2); auto iovcnt = output->riovec(iov.data(), 2);
if (iovcnt == 0) { if (iovcnt == 0) {
send_reply(200, API_SUCCESS); send_reply(200, API_SUCCESS);
@ -210,8 +210,8 @@ int APIDownstreamConnection::end_upload_data() {
auto len = output->rleft(); auto len = output->rleft();
output->remove(large_buf.get(), len); output->remove(large_buf.get(), len);
iov.iov_base = large_buf.get(); iov[0].iov_base = large_buf.get();
iov.iov_len = len; iov[0].iov_len = len;
} }
Config config{}; Config config{};
@ -229,8 +229,8 @@ int APIDownstreamConnection::end_upload_data() {
std::set<StringRef> include_set; std::set<StringRef> include_set;
for (auto first = reinterpret_cast<const uint8_t *>(iov.iov_base), for (auto first = reinterpret_cast<const uint8_t *>(iov[0].iov_base),
last = first + iov.iov_len; last = first + iov[0].iov_len;
first != last;) { first != last;) {
auto eol = std::find(first, last, '\n'); auto eol = std::find(first, last, '\n');
if (eol == last) { if (eol == last) {