diff --git a/src/fcgi.c b/src/fcgi.c index 1d1a82b4c..0ff76156f 100644 --- a/src/fcgi.c +++ b/src/fcgi.c @@ -198,7 +198,7 @@ size_t fcgi_decode_param(const struct buffer *in, size_t o, struct fcgi_param *p len += 4; } - if (data < nlen + vlen) + if (data < o + nlen + vlen) return 0; p->n = ist2(b_peek(in, o), nlen); @@ -253,7 +253,7 @@ size_t fcgi_aligned_decode_param(const struct buffer *in, size_t o, struct fcgi_ len += 4; } - if (data < nlen + vlen) + if (data < o + nlen + vlen) return 0; p->n = ist2(in->area + o, nlen);