From 96d7014323b16ea9827bb3c365c40cc2c018f34c Mon Sep 17 00:00:00 2001 From: freedom-winds Date: Tue, 11 Aug 2026 18:56:55 +0800 Subject: [PATCH] Prevent header NV allocation size overflow --- lib/nghttp3_frame.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/lib/nghttp3_frame.c b/lib/nghttp3_frame.c index 2efba747..4528bb97 100644 --- a/lib/nghttp3_frame.c +++ b/lib/nghttp3_frame.c @@ -149,13 +149,25 @@ int nghttp3_nva_copy(nghttp3_nv **pnva, const nghttp3_nv *nva, size_t nvlen, for (i = 0; i < nvlen; ++i) { /* + 1 for null-termination */ if ((nva[i].flags & NGHTTP3_NV_FLAG_NO_COPY_NAME) == 0) { + if (nva[i].namelen == SIZE_MAX || + buflen > SIZE_MAX - (nva[i].namelen + 1)) { + return NGHTTP3_ERR_INVALID_ARGUMENT; + } buflen += nva[i].namelen + 1; } if ((nva[i].flags & NGHTTP3_NV_FLAG_NO_COPY_VALUE) == 0) { + if (nva[i].valuelen == SIZE_MAX || + buflen > SIZE_MAX - (nva[i].valuelen + 1)) { + return NGHTTP3_ERR_INVALID_ARGUMENT; + } buflen += nva[i].valuelen + 1; } } + if (nvlen > SIZE_MAX / sizeof(nghttp3_nv) || + buflen > SIZE_MAX - sizeof(nghttp3_nv) * nvlen) { + return NGHTTP3_ERR_INVALID_ARGUMENT; + } buflen += sizeof(nghttp3_nv) * nvlen; *pnva = nghttp3_mem_malloc(mem, buflen);