details: http://hg.nginx.org/nginx/rev/ec0be12c8e29
branches:
changeset: 5352:ec0be12c8e29
user: Valentin Bartenev <vbart@nginx.com>
date: Thu Aug 29 22:35:54 2013 +0400
description:
Referer: fixed hostname buffer overflow check.

Because of premature check the effective buffer size was 255 symbols
while the buffer is able to handle 256.

diffstat:

src/http/modules/ngx_http_referer_module.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)

diffs (19 lines):

diff -r a2c772963b04 -r ec0be12c8e29 src/http/modules/ngx_http_referer_module.c
--- a/src/http/modules/ngx_http_referer_module.c Thu Aug 29 22:35:27 2013 +0400
+++ b/src/http/modules/ngx_http_referer_module.c Thu Aug 29 22:35:54 2013 +0400
@@ -178,12 +178,12 @@ valid_scheme:
break;
}

- buf[i] = ngx_tolower(*p);
- key = ngx_hash(key, buf[i++]);
-
if (i == 256) {
goto invalid;
}
+
+ buf[i] = ngx_tolower(*p);
+ key = ngx_hash(key, buf[i++]);
}

uri = ngx_hash_find_combined(&rlcf->hash, key, buf, p - ref);

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel