details: https://hg.nginx.org/nginx/rev/02a539522be4
branches:
changeset: 7605:02a539522be4
user: Ruslan Ermilov <ru@nginx.com>
date: Mon Dec 16 15:19:01 2019 +0300
description:
Tolerate '\0' in URI when mapping URI to path.

If a rewritten URI has the null character, only a part of URI was
copied to a memory buffer allocated for path. In some setups this
could be exploited to expose uninitialized memory via the Location
header.

diffstat:

src/http/ngx_http_core_module.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)

diffs (13 lines):

diff -r 7aa20af4ac00 -r 02a539522be4 src/http/ngx_http_core_module.c
--- a/src/http/ngx_http_core_module.c Mon Dec 16 15:19:01 2019 +0300
+++ b/src/http/ngx_http_core_module.c Mon Dec 16 15:19:01 2019 +0300
@@ -1843,7 +1843,8 @@
}
}

- last = ngx_cpystrn(last, r->uri.data + alias, r->uri.len - alias + 1);
+ last = ngx_copy(last, r->uri.data + alias, r->uri.len - alias);
+ *last = '\0';

return last;
}
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel