From 35a437d3d9e930401227cd5b214b7cffb02687d3 Mon Sep 17 00:00:00 2001 From: dgprivate Date: Sat, 29 Aug 2026 05:53:38 +0000 Subject: [PATCH] HTTP/3: avoid undefined behaviour with empty encoder field values A zero length field value in encoder stream instructions left the value data pointer NULL, passed then to ngx_memcpy() in ngx_http_v3_insert(). For the reasons outlined in b0a4d0fb8, it is now set to an empty string. --- src/http/v3/ngx_http_v3_parse.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/http/v3/ngx_http_v3_parse.c b/src/http/v3/ngx_http_v3_parse.c index 573a832ef..0a985e10b 100644 --- a/src/http/v3/ngx_http_v3_parse.c +++ b/src/http/v3/ngx_http_v3_parse.c @@ -1543,7 +1543,7 @@ ngx_http_v3_parse_field_inr(ngx_connection_t *c, st->literal.length = st->pint.value; if (st->literal.length == 0) { - st->value.len = 0; + ngx_str_set(&st->value, ""); goto done; } @@ -1667,7 +1667,7 @@ ngx_http_v3_parse_field_iln(ngx_connection_t *c, st->literal.length = st->pint.value; if (st->literal.length == 0) { - st->value.len = 0; + ngx_str_set(&st->value, ""); goto done; }