Fixed buffer overrun after changing chunk size.

Thanks to Zengxian Ding.
drothchild8 · May 24, 2021 · 2f2db81 · 2f2db81
1 parent afd350e
commit 2f2db81
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/ngx_rtmp_handler.c b/ngx_rtmp_handler.c
@@ -241,7 +241,9 @@ ngx_rtmp_recv(ngx_event_t *rev)
                     "reusing formerly read data: %d", old_size);
 
             b->pos = b->start;
-            b->last = ngx_movemem(b->pos, old_pos, old_size);
+
+            size = ngx_min((size_t) (b->end - b->start), old_size);
+            b->last = ngx_movemem(b->pos, old_pos, size);
 
             if (s->in_chunk_size_changing) {
                 ngx_rtmp_finalize_set_chunk_size(s);