News for hackers. Stuff that matters.

A comment on Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11).

Re:Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11) by IvyMike on Wednesday March 19, 2014 @03:29AM (#7427216) 

  -        if (ngx_list_init(&r->headers_in.headers, r->pool, sc->entries + 3,
  +        if (ngx_list_init(&r->headers_in.headers, r->pool, 20,
Personally, both the old code and the new code use magic numbers, and both send up a red flag to me. What does 20 mean? (I don't personally need an answer here: my point is it's not obvious and therefore it's easier for bugs to get through.)
[ Parent | on HN ]

There are no comments on this comment yet.