Fix out-of-bounds access
`encode_chunk` expects at least 3 elements of space, which was not
satisfied in some cases.
Fixes Coverity CID
@@ -511,6 +511,9 @@ static void swap_buffers(h2o_buffer_t **a, h2o_buffer_t **b)
*a = swap;
}
+/**
+ * bufs must have at least 3 elements of space
+ */
size_t encode_chunk(struct st_h2o_http1client_t *client, h2o_iovec_t *bufs, h2o_iovec_t chunk, size_t *bytes)
{
*bytes = 0;
@@ -681,7 +684,7 @@ static void on_connection_ready(struct st_h2o_http1client_t *client)
return;
}
- h2o_iovec_t reqbufs[3];
+ h2o_iovec_t reqbufs[4];
size_t reqbufcnt = 0;
if (props.proxy_protocol->base != NULL)
reqbufs[reqbufcnt++] = *props.proxy_protocol;
@@ -705,6 +708,7 @@ static void on_connection_ready(struct st_h2o_http1client_t *client)
if (client->_is_chunked) {
assert(body.base != NULL);
size_t bytes;
+ assert(PTLS_ELEMENTSOF(reqbufs) - reqbufcnt >= 3);
reqbufcnt += encode_chunk(client, reqbufs + reqbufcnt, body, &bytes);
client->super.bytes_written.body = bytes;
} else if (body.base != NULL) {
