details: http://hg.nginx.org/nginx/rev/b358d670c654
branches:
changeset: 6533:b358d670c654
user: Valentin Bartenev <vbart@nginx.com>
date: Wed May 11 17:55:20 2016 +0300
description:
Core: fixed port handling in ngx_parse_inet6_url().

This fixes buffer over-read when no port is specified in cases
similar to 5df5d7d771f6, and catches missing port separator.

diffstat:

src/core/ngx_inet.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)

diffs (17 lines):

diff -r 2f98b5709d79 -r b358d670c654 src/core/ngx_inet.c
--- a/src/core/ngx_inet.c Thu Apr 28 16:30:19 2016 +0300
+++ b/src/core/ngx_inet.c Wed May 11 17:55:20 2016 +0300
@@ -861,7 +861,12 @@ ngx_parse_inet6_url(ngx_pool_t *pool, ng
last = uri;
}

- if (*port == ':') {
+ if (port < last) {
+ if (*port != ':') {
+ u->err = "invalid host";
+ return NGX_ERROR;
+ }
+
port++;

len = last - port;

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel