> As already noted off-list, this is certainly not the only field
> which might be not yet set when
> ngx_http_alloc_large_header_buffer() is called. From the patch
> context as shown, at least r->method_end and r->uri_start might
> not be set as well, leading to similar overflows. And certainly
> there are other fields as well.

Agreed, there is a clear pattern in this case.
I have updated the patch to test other cases as well.

Also, I've created a separate patch to remove r->port_start,
which is actually unused and looks like remnant of old refactoring.

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
https://mailman.nginx.org/mailman/listinfo/nginx-devel