From e419e28c98378ecf4e373f0c660e6c03665efd62 Mon Sep 17 00:00:00 2001 From: Sergey Kandaurov Date: Thu, 6 Aug 2026 21:14:27 +0400 Subject: [PATCH] Fixed overflow detection in chunked parser This was broken in f405ef11f (1.29.4). Reported by Matt Suiche, Tolmo Inc. --- src/http/ngx_http_parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c index e1328da04..e547d0fdb 100644 --- a/src/http/ngx_http_parse.c +++ b/src/http/ngx_http_parse.c @@ -2420,7 +2420,7 @@ data: ctx->state = state; b->pos = pos; - if (ctx->size > NGX_MAX_OFF_T_VALUE - 5) { + if (ctx->size > NGX_MAX_OFF_T_VALUE - 9) { goto invalid; }