From: Aron Xu <aron@debian.org>
Date: Mon, 26 Aug 2019 11:55:33 +0000 (+0100)
Subject: .0.5-CVE-backport
X-Git-Tag: archive/raspbian/8.0.2+ds-1+rpi1+deb10u1^2~1
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=473d3af4b24897f02f0fd727b34fba09be1ae3c6;p=trafficserver.git

.0.5-CVE-backport


Gbp-Pq: Name 0015-8.0.5-CVE-backport.patch
---

diff --git a/proxy/http2/Http2ConnectionState.cc b/proxy/http2/Http2ConnectionState.cc
index af61dd85..1460e454 100644
--- a/proxy/http2/Http2ConnectionState.cc
+++ b/proxy/http2/Http2ConnectionState.cc
@@ -304,10 +304,12 @@ rcv_headers_frame(Http2ConnectionState &cstate, const Http2Frame &frame)
     }
   }
 
-  stream->header_blocks = static_cast<uint8_t *>(ats_malloc(header_block_fragment_length));
-  frame.reader()->memcpy(stream->header_blocks, header_block_fragment_length, header_block_fragment_offset);
+  if (header_block_fragment_length > 0) {
+    stream->header_blocks = static_cast<uint8_t *>(ats_malloc(header_block_fragment_length));
+    frame.reader()->memcpy(stream->header_blocks, header_block_fragment_length, header_block_fragment_offset);
 
-  stream->header_blocks_length = header_block_fragment_length;
+    stream->header_blocks_length = header_block_fragment_length;
+  }
 
   if (frame.header().flags & HTTP2_FLAGS_HEADERS_END_HEADERS) {
     // NOTE: If there are END_HEADERS flag, decode stored Header Blocks.