BUG/MINOR: quic: Wrong buffer length passed to generate_retry_token()
After having consumed <i> bytes from <buf>, the remaining available room to be
passed to generate_retry_token() is sizeof(buf) - i.
This bug could be easily reproduced with quic-qo as client which chooses a random
value as ODCID length.
diff --git a/src/xprt_quic.c b/src/xprt_quic.c
index 9a1e9eb..d0beb50 100644
--- a/src/xprt_quic.c
+++ b/src/xprt_quic.c
@@ -4249,8 +4249,9 @@
i += scid.len;
/* token */
- if (!(token_len = generate_retry_token(&buf[i], &buf[i] - buf, pkt)))
+ if (!(token_len = generate_retry_token(&buf[i], sizeof(buf) - i, pkt)))
return 1;
+
i += token_len;
/* token integrity tag */