From 2905bcad53e5aeb78e3b92aba1152f7ac57fd651 Mon Sep 17 00:00:00 2001
From: Kawe Mazidjatari <48657826+Mauler125@users.noreply.github.com>
Date: Mon, 12 Jun 2023 19:47:37 +0200
Subject: [PATCH] Fix 'CVE-2018-1000005'

Merge: curl/curl@fa3dbb9a147488a294
---
 r5dev/thirdparty/curl/http2.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/r5dev/thirdparty/curl/http2.c b/r5dev/thirdparty/curl/http2.c
index 264c6670..a5056ca2 100644
--- a/r5dev/thirdparty/curl/http2.c
+++ b/r5dev/thirdparty/curl/http2.c
@@ -880,8 +880,8 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
 
   if(stream->bodystarted) {
     /* This is trailer fields. */
-    /* 3 is for ":" and "\r\n". */
-    uint32_t n = (uint32_t)(namelen + valuelen + 3);
+    /* 4 is for ":" and "\r\n". */
+    uint32_t n = (uint32_t)(namelen + valuelen + 4);
 
     DEBUGF(infof(data_s, "h2 trailer: %.*s: %.*s\n", namelen, name, valuelen,
                  value));