diff options
| author | Nicholas Hurley <hurley@mozilla.com> | 2017-03-21 15:24:07 +0100 |
|---|---|---|
| committer | Pale Moon <git-repo@palemoon.org> | 2017-03-27 19:31:46 +0200 |
| commit | 1153da16710bc4d93d94c6db762fc982ba42f3c6 (patch) | |
| tree | 07177d79f26f7b604be6738f929118942a7f43d1 /netwerk | |
| parent | 6f288190e5c6cd836f7a27c03b1422d617e7d318 (diff) | |
| download | palemoon-gre-1153da16710bc4d93d94c6db762fc982ba42f3c6.tar.gz | |
Bug 1343505 r=mcmanus a=abillings
MozReview-Commit-ID: 7OPJQfzW4FU
Diffstat (limited to 'netwerk')
| -rw-r--r-- | netwerk/protocol/http/Http2Session.cpp | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/netwerk/protocol/http/Http2Session.cpp b/netwerk/protocol/http/Http2Session.cpp index 87745aba4..4763f6dff 100644 --- a/netwerk/protocol/http/Http2Session.cpp +++ b/netwerk/protocol/http/Http2Session.cpp @@ -2647,7 +2647,11 @@ Http2Session::WriteSegments(nsAHttpSegmentWriter *writer, LOG3(("Http2Session::WriteSegments %p stream 0x%X mPaddingLength=%d", this, mInputFrameID, mPaddingLength)); - if (1U + mPaddingLength == mInputFrameDataSize) { + if (1U + mPaddingLength > mInputFrameDataSize) { + LOG3(("Http2Session::WriteSegments %p stream 0x%X padding too large for " + "frame", this, mInputFrameID)); + RETURN_SESSION_ERROR(this, PROTOCOL_ERROR); + } else if (1U + mPaddingLength == mInputFrameDataSize) { // This frame consists entirely of padding, we can just discard it LOG3(("Http2Session::WriteSegments %p stream 0x%X frame with only padding", this, mInputFrameID)); |