details: http://hg.nginx.org/nginx/rev/6b1b8c4b7a95
branches:
changeset: 6671:6b1b8c4b7a95
user: Roman Arutyunyan <arut@nginx.com>
date: Thu Sep 01 14:33:51 2016 +0300
description:
Realip: fixed uninitialized memory access.

Previously, the realip module could be left with uninitialized context after an
error in the ngx_http_realip_set_addr() function. That context could be later
accessed by $realip_remote_addr and $realip_remote_port variable handlers.

diffstat:

src/http/modules/ngx_http_realip_module.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diffs (19 lines):

diff -r c6372a40c2a7 -r 6b1b8c4b7a95 src/http/modules/ngx_http_realip_module.c
--- a/src/http/modules/ngx_http_realip_module.c Fri Aug 26 15:33:07 2016 +0300
+++ b/src/http/modules/ngx_http_realip_module.c Thu Sep 01 14:33:51 2016 +0300
@@ -264,7 +264,6 @@ ngx_http_realip_set_addr(ngx_http_reques
}

ctx = cln->data;
- ngx_http_set_ctx(r, ctx, ngx_http_realip_module);

c = r->connection;

@@ -282,6 +281,7 @@ ngx_http_realip_set_addr(ngx_http_reques
ngx_memcpy(p, text, len);

cln->handler = ngx_http_realip_cleanup;
+ ngx_http_set_ctx(r, ctx, ngx_http_realip_module);

ctx->connection = c;
ctx->sockaddr = c->sockaddr;

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel