CERBERUS/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-06-29 21:31:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add missing bounds check in ngx_{http,stream}_compile_complex_value()
Some checks failed
buildbot / buildbot (push) Has been cancelled
Details

Browse source 
Complex value compilation scans strings for $1..$9 capture references.
Check that a byte after '$' is present before testing it, matching
ngx_str_t length semantics and avoiding reliance on NUL termination.

Apply the same check to both HTTP and stream implementations.
This commit is contained in:
Feng Wu 2026-06-24 07:22:43 +08:00 • committed by VadimZhestikov
parent 2d71bdcf8b
commit 42f8df65b6
2 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/http/ngx_http_script.c
View file

@ -150,7 +150,9 @@ ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
for (i = 0; i < v->len; i++) {
if (v->data[i] == '$') {
if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {
if (i + 1 < v->len
&& v->data[i + 1] >= '1' && v->data[i + 1] <= '9')
{
nc++;
} else {

4
src/stream/ngx_stream_script.c
View file

@ -151,7 +151,9 @@ ngx_stream_compile_complex_value(ngx_stream_compile_complex_value_t *ccv)
for (i = 0; i < v->len; i++) {
if (v->data[i] == '$') {
if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {
if (i + 1 < v->len
&& v->data[i + 1] >= '1' && v->data[i + 1] <= '9')
{
nc++;
} else {