Author: mdounin
Date: 2012-03-15 11:41:43 +0000 (Thu, 15 Mar 2012)
New Revision: 4535

Log:
Merge of r4530, r4531: null character fixes.

*) Fixed incorrect ngx_cpystrn() usage in ngx_http_*_process_header().

This resulted in a disclosure of previously freed memory if upstream
server returned specially crafted response, potentially exposing
sensitive information.

Reported by Matthew Daley.

*) Headers with null character are now rejected.

Headers with NUL character aren't allowed by HTTP standard and may cause
various security problems. They are now unconditionally rejected.


Modified:
branches/stable-1.0/
branches/stable-1.0/src/http/modules/ngx_http_fastcgi_module.c
branches/stable-1.0/src/http/modules/ngx_http_proxy_module.c
branches/stable-1.0/src/http/modules/ngx_http_scgi_module.c
branches/stable-1.0/src/http/modules/ngx_http_uwsgi_module.c
branches/stable-1.0/src/http/ngx_http_parse.c


Property changes on: branches/stable-1.0
___________________________________________________________________
Modified: svn:mergeinfo
- /trunk:3960-3974,3977-3987,3991-3996,3998,4000-4018,4020,4023,4025-4027,4034-4065,4073,4077,4086-4090,4094-4102,4106-4108,4113-4114,4129-4137,4143-4144,4147-4158,4177,4179,4182-4184,4186-4187,4189-4205,4207,4209-4210,4212,4217-4223,4227-4232,4235-4237,4265-4268,4270,4274-4276,4278-4280,4282-4284,4294-4295,4298,4300-4309,4313,4315,4320-4321,4326-4327,4335-4336,4338-4343,4372-4375,4377,4379,4381-4385,4393,4396,4398,4400-4406,4413,4415-4416,4422-4423,4460-4461,4468,4470-4471,4473-4474,4491-4493,4497-4500
+ /trunk:3960-3974,3977-3987,3991-3996,3998,4000-4018,4020,4023,4025-4027,4034-4065,4073,4077,4086-4090,4094-4102,4106-4108,4113-4114,4129-4137,4143-4144,4147-4158,4177,4179,4182-4184,4186-4187,4189-4205,4207,4209-4210,4212,4217-4223,4227-4232,4235-4237,4265-4268,4270,4274-4276,4278-4280,4282-4284,4294-4295,4298,4300-4309,4313,4315,4320-4321,4326-4327,4335-4336,4338-4343,4372-4375,4377,4379,4381-4385,4393,4396,4398,4400-4406,4413,4415-4416,4422-4423,4460-4461,4468,4470-4471,4473-4474,4491-4493,4497-4500,4530-4531

Modified: branches/stable-1.0/src/http/modules/ngx_http_fastcgi_module.c
===================================================================
--- branches/stable-1.0/src/http/modules/ngx_http_fastcgi_module.c 2012-03-15 11:37:11 UTC (rev 4534)
+++ branches/stable-1.0/src/http/modules/ngx_http_fastcgi_module.c 2012-03-15 11:41:43 UTC (rev 4535)
@@ -1446,10 +1446,10 @@
h->lowcase_key = h->key.data + h->key.len + 1
+ h->value.len + 1;

- ngx_cpystrn(h->key.data, r->header_name_start,
- h->key.len + 1);
- ngx_cpystrn(h->value.data, r->header_start,
- h->value.len + 1);
+ ngx_memcpy(h->key.data, r->header_name_start, h->key.len);
+ h->key.data[h->key.len] = '\0';
+ ngx_memcpy(h->value.data, r->header_start, h->value.len);
+ h->value.data[h->value.len] = '\0';
}

h->hash = r->header_hash;

Modified: branches/stable-1.0/src/http/modules/ngx_http_proxy_module.c
===================================================================
--- branches/stable-1.0/src/http/modules/ngx_http_proxy_module.c 2012-03-15 11:37:11 UTC (rev 4534)
+++ branches/stable-1.0/src/http/modules/ngx_http_proxy_module.c 2012-03-15 11:41:43 UTC (rev 4535)
@@ -1278,8 +1278,10 @@
h->value.data = h->key.data + h->key.len + 1;
h->lowcase_key = h->key.data + h->key.len + 1 + h->value.len + 1;

- ngx_cpystrn(h->key.data, r->header_name_start, h->key.len + 1);
- ngx_cpystrn(h->value.data, r->header_start, h->value.len + 1);
+ ngx_memcpy(h->key.data, r->header_name_start, h->key.len);
+ h->key.data[h->key.len] = '\0';
+ ngx_memcpy(h->value.data, r->header_start, h->value.len);
+ h->value.data[h->value.len] = '\0';

if (h->key.len == r->lowcase_index) {
ngx_memcpy(h->lowcase_key, r->lowcase_header, h->key.len);

Modified: branches/stable-1.0/src/http/modules/ngx_http_scgi_module.c
===================================================================
--- branches/stable-1.0/src/http/modules/ngx_http_scgi_module.c 2012-03-15 11:37:11 UTC (rev 4534)
+++ branches/stable-1.0/src/http/modules/ngx_http_scgi_module.c 2012-03-15 11:41:43 UTC (rev 4535)
@@ -894,8 +894,10 @@
h->value.data = h->key.data + h->key.len + 1;
h->lowcase_key = h->key.data + h->key.len + 1 + h->value.len + 1;

- ngx_cpystrn(h->key.data, r->header_name_start, h->key.len + 1);
- ngx_cpystrn(h->value.data, r->header_start, h->value.len + 1);
+ ngx_memcpy(h->key.data, r->header_name_start, h->key.len);
+ h->key.data[h->key.len] = '\0';
+ ngx_memcpy(h->value.data, r->header_start, h->value.len);
+ h->value.data[h->value.len] = '\0';

if (h->key.len == r->lowcase_index) {
ngx_memcpy(h->lowcase_key, r->lowcase_header, h->key.len);

Modified: branches/stable-1.0/src/http/modules/ngx_http_uwsgi_module.c
===================================================================
--- branches/stable-1.0/src/http/modules/ngx_http_uwsgi_module.c 2012-03-15 11:37:11 UTC (rev 4534)
+++ branches/stable-1.0/src/http/modules/ngx_http_uwsgi_module.c 2012-03-15 11:41:43 UTC (rev 4535)
@@ -947,8 +947,10 @@
h->value.data = h->key.data + h->key.len + 1;
h->lowcase_key = h->key.data + h->key.len + 1 + h->value.len + 1;

- ngx_cpystrn(h->key.data, r->header_name_start, h->key.len + 1);
- ngx_cpystrn(h->value.data, r->header_start, h->value.len + 1);
+ ngx_memcpy(h->key.data, r->header_name_start, h->key.len);
+ h->key.data[h->key.len] = '\0';
+ ngx_memcpy(h->value.data, r->header_start, h->value.len);
+ h->value.data[h->value.len] = '\0';

if (h->key.len == r->lowcase_index) {
ngx_memcpy(h->lowcase_key, r->lowcase_header, h->key.len);

Modified: branches/stable-1.0/src/http/ngx_http_parse.c
===================================================================
--- branches/stable-1.0/src/http/ngx_http_parse.c 2012-03-15 11:37:11 UTC (rev 4534)
+++ branches/stable-1.0/src/http/ngx_http_parse.c 2012-03-15 11:41:43 UTC (rev 4535)
@@ -814,6 +814,10 @@
break;
}

+ if (ch == '\0') {
+ return NGX_HTTP_PARSE_INVALID_HEADER;
+ }
+
r->invalid_header = 1;

break;
@@ -876,6 +880,10 @@
break;
}

+ if (ch == '\0') {
+ return NGX_HTTP_PARSE_INVALID_HEADER;
+ }
+
r->invalid_header = 1;

break;
@@ -894,6 +902,8 @@
r->header_start = p;
r->header_end = p;
goto done;
+ case '\0':
+ return NGX_HTTP_PARSE_INVALID_HEADER;
default:
r->header_start = p;
state = sw_value;
@@ -915,6 +925,8 @@
case LF:
r->header_end = p;
goto done;
+ case '\0':
+ return NGX_HTTP_PARSE_INVALID_HEADER;
}
break;

@@ -928,6 +940,8 @@
break;
case LF:
goto done;
+ case '\0':
+ return NGX_HTTP_PARSE_INVALID_HEADER;
default:
state = sw_value;
break;

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel