Author: ru
Date: 2012-04-26 12:58:42 +0000 (Thu, 26 Apr 2012)
New Revision: 4611
URL: http://trac.nginx.org/nginx/changeset/4611/nginx

Log:
Fixed segmentation fault in ngx_resolver_create_name_query().

If name passed for resolution was { 0, NULL } (e.g. as a result
of name server returning CNAME pointing to ".") pointer wrapped
to (void *) -1 resulting in segmentation fault on an attempt to
dereference it.

Reported by Lanshun Zhou.


Modified:
trunk/src/core/ngx_resolver.c

Modified: trunk/src/core/ngx_resolver.c
===================================================================
--- trunk/src/core/ngx_resolver.c 2012-04-26 11:20:29 UTC (rev 4610)
+++ trunk/src/core/ngx_resolver.c 2012-04-26 12:58:42 UTC (rev 4611)
@@ -1834,6 +1834,10 @@
p--;
*p-- = '\0';

+ if (ctx->name.len == 0) {
+ return NGX_DECLINED;
+ }
+
for (s = ctx->name.data + ctx->name.len - 1; s >= ctx->name.data; s--) {
if (*s != '.') {
*p = *s;

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel