[PATCH] HTTP/3: fixed NGX_HTTP_V3_VARLEN_INT_LEN value
Maxim Dounin
mdounin at mdounin.ru
Thu Jun 11 13:17:44 UTC 2026
# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1781172660 -10800
# Thu Jun 11 13:11:00 2026 +0300
# Node ID ba68cb5eeb1a46c189a1baef5f4b3b083a2f77e0
# Parent 9647f416bbae2c122d3a68976914b7228a8cf15f
HTTP/3: fixed NGX_HTTP_V3_VARLEN_INT_LEN value.
This change was missed in 8349:b13176e717ba, and in theory might cause
1-byte buffer overwrite in ngx_http_v3_body_filter() if memory buffers
larger than 1G are used (which is unlikely in practice).
See also:
https://github.com/freenginx/nginx/issues/21
https://github.com/nginx/nginx/commit/0f9f43b79eed64ab1a876be76ff0f49d499784fc
diff --git a/src/http/v3/ngx_http_v3.h b/src/http/v3/ngx_http_v3.h
--- a/src/http/v3/ngx_http_v3.h
+++ b/src/http/v3/ngx_http_v3.h
@@ -23,7 +23,7 @@
#define NGX_HTTP_V3_HQ_ALPN_PROTO "\x0Ahq-interop"
#define NGX_HTTP_V3_HQ_PROTO "hq-interop"
-#define NGX_HTTP_V3_VARLEN_INT_LEN 4
+#define NGX_HTTP_V3_VARLEN_INT_LEN 8
#define NGX_HTTP_V3_PREFIX_INT_LEN 11
#define NGX_HTTP_V3_STREAM_CONTROL 0x00
More information about the nginx-devel
mailing list