|
|
@ -1399,6 +1399,13 @@ h2_parse_frames (connection * const con) |
|
|
|
c = cq->first; /*(reload after h2_frame_cq_compact())*/ |
|
|
|
} |
|
|
|
uint8_t *s = (uint8_t *)(c->mem->ptr + c->offset); |
|
|
|
#ifdef __COVERITY__ |
|
|
|
/* Coverity does not notice that values used in s are checked. |
|
|
|
* Although silencing here, would prefer not to do so since doing so |
|
|
|
* disables Coverity from reporting questionable modifications which |
|
|
|
* might be made to the code in the future. */ |
|
|
|
__coverity_tainted_data_sink__(s); |
|
|
|
#endif |
|
|
|
uint32_t flen = (s[0] << 16) | (s[1] << 8) | s[2]; |
|
|
|
if (flen > fsize) { |
|
|
|
h2_send_goaway_e(con, H2_E_FRAME_SIZE_ERROR); |
|
|
|