Skip to content

Commit

Permalink
HTTP/2: fixed possible buffer overrun (ticket #893).
Browse files Browse the repository at this point in the history
Due to greater priority of the unary plus operator over the ternary operator
the expression didn't work as expected.  That might result in one byte less
allocation than needed for the HEADERS frame buffer.
  • Loading branch information
VBart committed Feb 4, 2016
1 parent cb173ff commit 9add42c
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions src/http/v2/ngx_http_v2_filter_module.c
Original file line number Diff line number Diff line change
Expand Up @@ -215,8 +215,8 @@ ngx_http_v2_header_filter(ngx_http_request_t *r)
clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);

if (r->headers_out.server == NULL) {
len += 1 + clcf->server_tokens ? ngx_http_v2_literal_size(NGINX_VER)
: ngx_http_v2_literal_size("nginx");
len += 1 + (clcf->server_tokens ? ngx_http_v2_literal_size(NGINX_VER)
: ngx_http_v2_literal_size("nginx"));
}

if (r->headers_out.date == NULL) {
Expand Down

0 comments on commit 9add42c

Please sign in to comment.