Commit 19ed13c7 authored by Tatsuhiro Tsujikawa's avatar Tatsuhiro Tsujikawa

Fix off-by-one error when computing padding

parent b8ed74c1
...@@ -4158,7 +4158,7 @@ static ssize_t inbound_frame_compute_pad(nghttp2_inbound_frame *iframe) ...@@ -4158,7 +4158,7 @@ static ssize_t inbound_frame_compute_pad(nghttp2_inbound_frame *iframe)
DEBUGF(fprintf(stderr, "recv: padlen=%zu\n", padlen)); DEBUGF(fprintf(stderr, "recv: padlen=%zu\n", padlen));
/* We cannot use iframe->frame.hd.length because of CONTINUATION */ /* We cannot use iframe->frame.hd.length because of CONTINUATION */
if(padlen - (padlen > 255) - 1 > iframe->payloadleft) { if(padlen - (padlen > 256) - 1 > iframe->payloadleft) {
return -1; return -1;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment