diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2023-01-03 16:24:45 +0400 |
|---|---|---|
| committer | Roman Arutyunyan <arut@nginx.com> | 2023-01-03 16:24:45 +0400 |
| commit | d04f45ac5bddb034ec8c5b0874a7358a991d1b77 (patch) | |
| tree | 54f91b662850337657f5109bc70b273f8e04cf25 /src/http/v3/ngx_http_v3_request.c | |
| parent | f5aa66bd309a4cbec67285770c77db5d33347c27 (diff) | |
| download | nginx-d04f45ac5bddb034ec8c5b0874a7358a991d1b77.tar.gz nginx-d04f45ac5bddb034ec8c5b0874a7358a991d1b77.zip | |
HTTP/3: handled insertion reference to a going to be evicted entry.
As per RFC 9204, section 3.2.2, a new entry can reference an entry in the
dynamic table that will be evicted when adding this new entry into the dynamic
table.
Previously, such inserts resulted in use-after-free since the old entry was
evicted before the insertion (ticket #2431). Now it's evicted after the
insertion.
This change fixes Insert with Name Reference and Duplicate encoder instructions.
Diffstat (limited to 'src/http/v3/ngx_http_v3_request.c')
0 files changed, 0 insertions, 0 deletions