If URI is not fully parsed yet, the r->uri_end pointer is NULL.
As a result, calculation of "new + (r->uri_end - old)" expression
may overflow. In such case, just avoid calculating it, as r->uri_end
will be set correctly later by the parser in any case.
The issue was found by GCC undefined behaviour sanitizer.
src/http/ngx_http_request.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
https://mailman.nginx.org/mailman/listinfo/nginx-devel