From 2265b3c2b9fefc7b2065ea160466f3a6c0b025d3 Mon Sep 17 00:00:00 2001
From: Maxim Dounin <mdounin@mdounin.ru>
Date: Mon, 13 May 2013 13:19:28 +0400
Subject: [PATCH] Fixed chunk size parsing.

---
 src/http/modules/ngx_http_proxy_module.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c
index 977bed73c..0566213db 100644
--- a/src/http/modules/ngx_http_proxy_module.c
+++ b/src/http/modules/ngx_http_proxy_module.c
@@ -1865,6 +1865,10 @@ data:
 
     }
 
+    if (ctx->size < 0 || ctx->length < 0) {
+        goto invalid;
+    }
+
     return rc;
 
 done: