Author: mdounin
Date: 2012-11-21 00:51:37 +0000 (Wed, 21 Nov 2012)
New Revision: 4919
URL: http://trac.nginx.org/nginx/changeset/4919/nginx

Log:
Dav: fixed segfault on PUT if body was already read (ticket #238).

If request body reading happens with different options it's possible
that there will be no r->request_body->temp_file available (or even
no r->request_body available if body was discarded). Return internal
server error in this case instead of committing suicide by dereferencing
a null pointer.


Modified:
trunk/src/http/modules/ngx_http_dav_module.c

Modified: trunk/src/http/modules/ngx_http_dav_module.c
===================================================================
--- trunk/src/http/modules/ngx_http_dav_module.c 2012-11-20 13:37:55 UTC (rev 4918)
+++ trunk/src/http/modules/ngx_http_dav_module.c 2012-11-21 00:51:37 UTC (rev 4919)
@@ -209,6 +209,11 @@
ngx_ext_rename_file_t ext;
ngx_http_dav_loc_conf_t *dlcf;

+ if (r->request_body == NULL || r->request_body->temp_file == NULL) {
+ ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+ return;
+ }
+
ngx_http_map_uri_to_path(r, &path, &root, 0);

path.len--;

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel