diff options
| author | Valentin Bartenev <vbart@nginx.com> | 2014-05-29 21:15:19 +0400 |
|---|---|---|
| committer | Valentin Bartenev <vbart@nginx.com> | 2014-05-29 21:15:19 +0400 |
| commit | 68336e1ede6c37e3ee1f8b5e1ca9d4226feef8f5 (patch) | |
| tree | d08768e51b7183258541f2bf5472097dbbbad732 /src | |
| parent | 0750df4f16d6e39dfdf36ce69f363499aceff7d5 (diff) | |
| download | nginx-68336e1ede6c37e3ee1f8b5e1ca9d4226feef8f5.tar.gz nginx-68336e1ede6c37e3ee1f8b5e1ca9d4226feef8f5.zip | |
SPDY: fixed operator precedence in uint16/uint32 write macros.
Since the type cast has precedence higher than the bit shift operator,
all values were truncated to 8 bits.
These macros are used to construct header block for SYN_REPLY frame on
platforms with strict alignment requirements. As a result, any response
that contains a header with name or value longer than 255 bytes was
corrupted on such platforms.
Diffstat (limited to 'src')
| -rw-r--r-- | src/http/ngx_http_spdy.h | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/src/http/ngx_http_spdy.h b/src/http/ngx_http_spdy.h index 55aceda89..df24495a1 100644 --- a/src/http/ngx_http_spdy.h +++ b/src/http/ngx_http_spdy.h @@ -230,13 +230,16 @@ ngx_int_t ngx_http_spdy_send_output_queue(ngx_http_spdy_connection_t *sc); #else #define ngx_spdy_frame_write_uint16(p, s) \ - ((p)[0] = (u_char) (s) >> 8, (p)[1] = (u_char) (s), (p) + sizeof(uint16_t)) + ((p)[0] = (u_char) ((s) >> 8), \ + (p)[1] = (u_char) (s), \ + (p) + sizeof(uint16_t)) #define ngx_spdy_frame_write_uint32(p, s) \ - ((p)[0] = (u_char) (s) >> 24, \ - (p)[1] = (u_char) (s) >> 16, \ - (p)[2] = (u_char) (s) >> 8, \ - (p)[3] = (u_char) (s), (p) + sizeof(uint32_t)) + ((p)[0] = (u_char) ((s) >> 24), \ + (p)[1] = (u_char) ((s) >> 16), \ + (p)[2] = (u_char) ((s) >> 8), \ + (p)[3] = (u_char) (s), \ + (p) + sizeof(uint32_t)) #endif |