Possible buffer overrun

[barlone@…]

Piece of code in file 'ngx_http_v2_filter_module.c', function ngx_http_v2_header_filter:

 len += 1 + clcf->server_tokens ? ngx_http_v2_literal_size(NGINX_VER)
                                : ngx_http_v2_literal_size("nginx");

Here is calculating the length of the memory block that is allocated and filled in later. 1 not added, one byte out of allocated buffer access possible.

Expected behavior: add 1, then add size of one of two litetals.
Actual behavior: due to operator pecedence ('+' has greater priority than ternary condition), always add only size of first literal.

[Valentin V. Bartenev]

Nice catch, thanks.

[Valentin Bartenev <vbart@…>]

In 6377:11e019750adc/nginx:

HTTP/2: fixed possible buffer overrun (ticket #893).

Due to greater priority of the unary plus operator over the ternary operator
the expression didn't work as expected. That might result in one byte less
allocation than needed for the HEADERS frame buffer.