# HG changeset patch
# User Roman Arutyunyan <arut@nginx.com>
# Date 1716902330 -14400
# Node ID acb8548c00e9b8deb0bf48ea41f86adf7ccd3d1b
# Parent  081d4beeb591dd5737c26bfb0647e536979801f3
HTTP/3: fixed dynamic table overflow.

While inserting a new entry into the dynamic table, first the entry is added,
and then older entries are evicted until table size is within capacity.  After
the first step, the number of entries may temporarily exceed the maximum
calculated from capacity by one entry, which previously caused table overflow.

The easiest way to trigger the issue is to keep adding entries with empty names
and values until first eviction.

The issue was introduced by 987bee4363d1.

diff -r 081d4beeb591 -r acb8548c00e9 src/http/v3/ngx_http_v3_table.c
--- a/src/http/v3/ngx_http_v3_table.c	Tue May 28 17:17:19 2024 +0400
+++ b/src/http/v3/ngx_http_v3_table.c	Tue May 28 17:18:50 2024 +0400
@@ -308,7 +308,7 @@
     prev_max = dt->capacity / 32;
 
     if (max > prev_max) {
-        elts = ngx_alloc(max * sizeof(void *), c->log);
+        elts = ngx_alloc((max + 1) * sizeof(void *), c->log);
         if (elts == NULL) {
             return NGX_ERROR;
         }