commit a785be76f62ef76683034b4df99e0f353bb58921
author Valentin Bartenev <vbart@nginx.com> Wed Apr 30 20:34:20 2014 +0400
committer Valentin Bartenev <vbart@nginx.com> Wed Apr 30 20:34:20 2014 +0400
tree 75e0b57e12b35e263d9acfa6b8ffa0a18c20ace6
parent 3f023a419394ac82d5a8454673ac9e117856c4e4

SPDY: added protection from overrun of the receive buffer.

src/http/ngx_http_spdy.c

diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
index e53e3aa..810d8d8 100644
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -1921,6 +1921,14 @@
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, sc->connection->log, 0,
                    "spdy frame complete pos:%p end:%p", pos, end);
 
+    if (pos > end) {
+        ngx_log_error(NGX_LOG_ALERT, sc->connection->log, 0,
+                      "receive buffer overrun");
+
+        ngx_debug_point();
+        return ngx_http_spdy_state_internal_error(sc);
+    }
+
     sc->handler = ngx_http_spdy_state_head;
     sc->stream = NULL;