details: http://hg.nginx.org/nginx/rev/0570e42ffeed
branches:
changeset: 5800:0570e42ffeed
user: Piotr Sikora <piotr@cloudflare.com>
date: Thu Jun 19 04:16:36 2014 -0700
description:
Perl: NULL-terminate argument list.

perl_parse() function expects argv/argc-style argument list,
which according to the C standard must be NULL-terminated,
that is: argv[argc] == NULL.

This change fixes a crash (SIGSEGV) that could happen because
of the buffer overrun during perl module initialization.

Signed-off-by: Piotr Sikora <piotr@cloudflare.com>

diffstat:

src/http/modules/perl/ngx_http_perl_module.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)

diffs (20 lines):

diff --git a/src/http/modules/perl/ngx_http_perl_module.c b/src/http/modules/perl/ngx_http_perl_module.c
--- a/src/http/modules/perl/ngx_http_perl_module.c
+++ b/src/http/modules/perl/ngx_http_perl_module.c
@@ -577,7 +577,7 @@ ngx_http_perl_create_interpreter(ngx_con

n = (pmcf->modules != NGX_CONF_UNSET_PTR) ? pmcf->modules->nelts * 2 : 0;

- embedding = ngx_palloc(cf->pool, (4 + n) * sizeof(char *));
+ embedding = ngx_palloc(cf->pool, (5 + n) * sizeof(char *));
if (embedding == NULL) {
goto fail;
}
@@ -595,6 +595,7 @@ ngx_http_perl_create_interpreter(ngx_con
embedding[n++] = "-Mnginx";
embedding[n++] = "-e";
embedding[n++] = "0";
+ embedding[n] = NULL;

n = perl_parse(perl, ngx_http_perl_xs_init, n, embedding, NULL);


_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel