BUG/MINOR: h3: prevent overflow when parsing SETTINGS
h3_parse_settings_frm() read one byte after the frame payload. Fix the
parsing code. In most cases, this has no impact as we are inside an
allocated buffer but it could cause a segfault depending on the buffer
alignment.
diff --git a/src/h3.c b/src/h3.c
index 75ab2b8..4293258 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -352,7 +352,7 @@
buf = (const unsigned char *)ncb_head(rxbuf);
end = buf + flen;
- while (buf <= end) {
+ while (buf < end) {
if (!quic_dec_int(&id, &buf, end) || !quic_dec_int(&value, &buf, end))
return 0;