1berry/nginx
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

QUIC: fixed split frames error handling.

Browse Source 
Do not corrupt frame data chain pointer on ngx_quic_read_buffer() error.
The error leads to closing a QUIC connection where the frame may be used
as part of the QUIC connection tear down, which envolves writing pending
frames, including this one.
This commit is contained in:
Sergey Kandaurov 2023-05-04 15:52:23 +04:00
parent ea51d2fce8
commit af18ce3506
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/event/quic/ngx_event_quic_frames.c
View File

@ -319,6 +319,7 @@ ngx_int_t
ngx_quic_split_frame(ngx_connection_t *c, ngx_quic_frame_t *f, size_t len) ngx_quic_split_frame(ngx_connection_t *c, ngx_quic_frame_t *f, size_t len)
{ {
size_t shrink; size_t shrink;
ngx_chain_t *out;
ngx_quic_frame_t *nf; ngx_quic_frame_t *nf;
ngx_quic_buffer_t qb; ngx_quic_buffer_t qb;
ngx_quic_ordered_frame_t *of, *onf; ngx_quic_ordered_frame_t *of, *onf;
@ -359,11 +360,13 @@ ngx_quic_split_frame(ngx_connection_t *c, ngx_quic_frame_t *f, size_t len)
ngx_memzero(&qb, sizeof(ngx_quic_buffer_t)); ngx_memzero(&qb, sizeof(ngx_quic_buffer_t));
qb.chain = f->data; qb.chain = f->data;
f->data = ngx_quic_read_buffer(c, &qb, of->length); out = ngx_quic_read_buffer(c, &qb, of->length);
if (f->data == NGX_CHAIN_ERROR) { if (out == NGX_CHAIN_ERROR) {
return NGX_ERROR; return NGX_ERROR;
} }
f->data = out;
nf = ngx_quic_alloc_frame(c); nf = ngx_quic_alloc_frame(c);
if (nf == NULL) { if (nf == NULL) {
return NGX_ERROR; return NGX_ERROR;