details: http://hg.nginx.org/nginx/rev/e0aa54a4357e
branches:
changeset: 5769:e0aa54a4357e
user: Maxim Dounin <mdounin@mdounin.ru>
date: Fri Jul 18 20:02:11 2014 +0400
description:
Reset of r->uri.len on URI parsing errors.

This ensures that debug logging and the $uri variable (if used in
400 Bad Request processing) will not try to access uninitialized
memory.

Found by Sergey Bobrov.

diffstat:

src/http/ngx_http_request.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)

diffs (12 lines):

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1071,6 +1071,8 @@ ngx_http_process_request_uri(ngx_http_re
cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);

if (ngx_http_parse_complex_uri(r, cscf->merge_slashes) != NGX_OK) {
+ r->uri.len = 0;
+
ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
"client sent invalid request");
ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel