--- src/http/ngx_http_parse.c +++ src/http/ngx_http_parse.c @@ -2209,6 +2209,10 @@ data: } + if (ctx->size < 0 || ctx->length < 0) { + goto invalid; + } + return rc; done: