ngtcp2: Fix stack buffer overflow

Closes #6521

diff --git a/lib/vquic/ngtcp2.c b/lib/vquic/ngtcp2.c
index e87f8f4ba4f2ff7974e4aa275ba2d1f6c70b8de5..f2fce76ff98a725b6944ce5809ada6f47c9acbd4 100644 (file)
--- a/lib/vquic/ngtcp2.c
+++ b/lib/vquic/ngtcp2.c
@@ -1334,13 +1334,14 @@ static ssize_t cb_h3_readfunction(nghttp3_conn *conn, int64_t stream_id,
       nread = H3_SEND_SIZE - out->windex;
 
     memcpy(&out->buf[out->windex], stream->upload_mem, nread);
-    out->windex += nread;
-    out->used += nread;
 
     /* that's the chunk we return to nghttp3 */
     vec[0].base = &out->buf[out->windex];
     vec[0].len = nread;
 
+    out->windex += nread;
+    out->used += nread;
+
     if(out->windex == H3_SEND_SIZE)
       out->windex = 0; /* wrap */
     stream->upload_mem += nread;