frame: ack-range also needs to be boundary checked
@@ -93,11 +93,12 @@ int quicly_decode_ack_frame(const uint8_t **src, const uint8_t *end, quicly_ack_
tmp += 1;
if (frame->smallest_acknowledged < tmp)
goto Error;
+ if (i < QUICLY_MAX_ACK_RANGE_COUNT) {
frame->ack_block_lengths[i + 1] = tmp;
frame->smallest_acknowledged -= tmp;
- if (i < QUICLY_MAX_ACK_RANGE_COUNT)
frame->gaps[i] = curr_gap;
}
+ }
if (is_ack_ecn) {
/* just skip ECT(0), ECT(1), ECT-CE counters for the time being */
