[trafficserver] branch quic-latest updated: Fix a buffer overflow

[ma...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

maskit pushed a commit to branch quic-latest
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/quic-latest by this push:
     new 387323a  Fix a buffer overflow
387323a is described below

commit 387323abc755f79317576fc717a64591f78640f3
Author: Masakazu Kitajo <ma...@apache.org>
AuthorDate: Wed Mar 7 17:34:07 2018 +0900

    Fix a buffer overflow
---
 iocore/net/quic/QUICFlowController.cc | 7 ++++++-
 iocore/net/quic/QUICStream.cc         | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/iocore/net/quic/QUICFlowController.cc b/iocore/net/quic/QUICFlowController.cc
index 66f9de9..7fac445 100644
--- a/iocore/net/quic/QUICFlowController.cc
+++ b/iocore/net/quic/QUICFlowController.cc
@@ -37,7 +37,12 @@ QUICFlowController::current_offset()
 QUICOffset
 QUICFlowController::current_limit()
 {
-  return this->_limit;
+  // if _limit is 0, the limit is not set yet.
+  if (this->_limit) {
+    return this->_limit;
+  } else {
+    return UINT64_MAX;
+  }
 }
 
 int
diff --git a/iocore/net/quic/QUICStream.cc b/iocore/net/quic/QUICStream.cc
index 87386b0..195ed4c 100644
--- a/iocore/net/quic/QUICStream.cc
+++ b/iocore/net/quic/QUICStream.cc
@@ -463,7 +463,7 @@ QUICStream::_process_write_vio()
     int64_t len      = 0;
     bool fin         = false;
 
-    int64_t credit = this->_remote_flow_controller.current_limit() - this->_remote_flow_controller.current_offset();
+    uint64_t credit = this->_remote_flow_controller.current_limit() - this->_remote_flow_controller.current_offset();
     if (credit != 0 && max_size > credit) {
       max_size = credit;
     }

-- 
To stop receiving notification emails like this one, please contact
maskit@apache.org.