diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/event/quic/ngx_event_quic.h | 1 | ||||
| -rw-r--r-- | src/event/quic/ngx_event_quic_streams.c | 16 |
2 files changed, 17 insertions, 0 deletions
diff --git a/src/event/quic/ngx_event_quic.h b/src/event/quic/ngx_event_quic.h index 83e72a6f3..230c2c46f 100644 --- a/src/event/quic/ngx_event_quic.h +++ b/src/event/quic/ngx_event_quic.h @@ -79,6 +79,7 @@ struct ngx_quic_stream_s { uint64_t send_max_data; uint64_t recv_max_data; uint64_t recv_offset; + uint64_t recv_last; uint64_t final_size; ngx_chain_t *in; ngx_uint_t cancelable; /* unsigned cancelable:1; */ diff --git a/src/event/quic/ngx_event_quic_streams.c b/src/event/quic/ngx_event_quic_streams.c index 816da61d5..d63938192 100644 --- a/src/event/quic/ngx_event_quic_streams.c +++ b/src/event/quic/ngx_event_quic_streams.c @@ -857,6 +857,8 @@ ngx_quic_handle_stream_frame(ngx_connection_t *c, ngx_quic_header_t *pkt, qs->final_size = last; } + qs->recv_last = last; + if (f->offset == 0) { sc->read->ready = 1; } @@ -884,6 +886,10 @@ ngx_quic_handle_stream_frame(ngx_connection_t *c, ngx_quic_header_t *pkt, return NGX_OK; } + if (qs->recv_last < last) { + qs->recv_last = last; + } + if (f->offset < qs->recv_offset) { ngx_quic_trim_bufs(frame->data, qs->recv_offset - f->offset); f->offset = qs->recv_offset; @@ -899,6 +905,11 @@ ngx_quic_handle_stream_frame(ngx_connection_t *c, ngx_quic_header_t *pkt, return NGX_ERROR; } + if (qs->recv_last > last) { + qc->error = NGX_QUIC_ERR_FINAL_SIZE_ERROR; + return NGX_ERROR; + } + qs->connection->read->pending_eof = 1; qs->final_size = last; } @@ -1129,6 +1140,11 @@ ngx_quic_handle_reset_stream_frame(ngx_connection_t *c, return NGX_ERROR; } + if (qs->recv_last > f->final_size) { + qc->error = NGX_QUIC_ERR_FINAL_SIZE_ERROR; + return NGX_ERROR; + } + qs->final_size = f->final_size; rev = qs->connection->read; |