[GNUnet-SVN] [gnurl] 98/125: http2: fix incorrect trailer buffer size

[gnunet]

This is an automated email from the git hooks/post-receive script.

ng0 pushed a commit to branch master
in repository gnurl.

commit fa3dbb9a147488a2943bda809c66fc497efe06cb
Author: Zhouyihai Ding <address@hidden>
AuthorDate: Wed Jan 10 10:12:18 2018 -0800

    http2: fix incorrect trailer buffer size
    
    Prior to this change the stored byte count of each trailer was
    miscalculated and 1 less than required. It appears any trailer
    after the first that was passed to Curl_client_write would be truncated
    or corrupted as well as the size. Potentially the size of some
    subsequent trailer could be erroneously extracted from the contents of
    that trailer, and since that size is used by client write an
    out-of-bounds read could occur and cause a crash or be otherwise
    processed by client write.
    
    The bug appears to have been born in 0761a51 (precedes 7.49.0).
    
    Closes https://github.com/curl/curl/pull/2231
---
 lib/http2.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/http2.c b/lib/http2.c
index 8e2fc7199..699287940 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -925,8 +925,8 @@ static int on_header(nghttp2_session *session, const 
nghttp2_frame *frame,
 
   if(stream->bodystarted) {
     /* This is trailer fields. */
-    /* 3 is for ":" and "\r\n". */
-    uint32_t n = (uint32_t)(namelen + valuelen + 3);
+    /* 4 is for ": " and "\r\n". */
+    uint32_t n = (uint32_t)(namelen + valuelen + 4);
 
     DEBUGF(infof(data_s, "h2 trailer: %.*s: %.*s\n", namelen, name, valuelen,
                  value));

-- 
To stop receiving notification emails like this one, please contact
address@hidden