Skip to content

Commit 6ed1188

Browse files
committed
HTTP/2: extended guard for NULL buffer and zero length.
In addition to moving memcpy() under the length condition in 15bf6d8, which addressed a reported UB due to string function conventions, this is repeated for advancing an input buffer, to make the resulting code more clean and readable. Additionally, although considered harmless for both string functions and additive operators, as previously discussed in GitHub PR 866, this fixes the main source of annoying sanitizer reports in the module. Prodded by UndefinedBehaviorSanitizer (pointer-overflow).
1 parent 9d04b66 commit 6ed1188

1 file changed

Lines changed: 5 additions & 6 deletions

File tree

src/http/v2/ngx_http_v2.c

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4113,15 +4113,14 @@ ngx_http_v2_process_request_body(ngx_http_request_t *r, u_char *pos,
41134113
n = size;
41144114
}
41154115

4116-
if (n > 0) {
4117-
rb->buf->last = ngx_cpymem(rb->buf->last, pos, n);
4118-
}
4119-
41204116
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, fc->log, 0,
41214117
"http2 request body recv %uz", n);
41224118

4123-
pos += n;
4124-
size -= n;
4119+
if (n > 0) {
4120+
rb->buf->last = ngx_cpymem(rb->buf->last, pos, n);
4121+
pos += n;
4122+
size -= n;
4123+
}
41254124

41264125
if (size == 0 && last) {
41274126
rb->rest = 0;

0 commit comments

Comments
 (0)