details: http://hg.nginx.org/nginx/rev/312472807db8
branches: stable-1.8
changeset: 6340:312472807db8
user: Maxim Dounin <mdounin@mdounin.ru>
date: Sun Aug 16 10:51:16 2015 +0300
description:
Fixed segfault with try_files introduced by c985d90a8d1f.

If alias was used in a location given by a regular expression,
nginx used to do wrong thing in try_files if a location name (i.e.,
regular expression) was an exact prefix of URI. The following
configuration triggered a segmentation fault on a request to "/mail":

location ~ /mail {
alias /path/to/directory;
try_files $uri =404;
}

Reported by Per Hansson.

diffstat:

src/http/ngx_http_core_module.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)

diffs (14 lines):

diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -1272,7 +1272,9 @@ ngx_http_core_try_files_phase(ngx_http_r

*e.pos = '\0';

- if (alias && ngx_strncmp(name, clcf->name.data, alias) == 0) {
+ if (alias && alias != NGX_MAX_SIZE_T_VALUE
+ && ngx_strncmp(name, clcf->name.data, alias) == 0)
+ {
ngx_memmove(name, name + alias, len - alias);
path.len -= alias;
}

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel