CERBERUS/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-08-04 14:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Script: improved compatibility of complex value codes
Some checks failed
buildbot / buildbot (push) Has been cancelled
Details

Browse source 
In a8289aa69c, we introduced a new code to finalize the evaluation of
a complex value, deferring the stack update to this new code.  However,
the change inadvertently broke compatibility with several third-party
modules that were reusing ngx_http_script_complex_value_code.

This change relegates omitted ngx_http_script_complex_value_end_code
from crash to a potential read of uninitialized bytes at the end of the
allocated buffer.
This commit is contained in:
Aleksei Bavshin 2026-07-16 08:53:21 -07:00 • committed by Aleksei Bavshin
parent 03baa844a9
commit 4b90ec7692
1 changed files with 11 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/http/ngx_http_script.c
View file

@ -1867,20 +1867,28 @@ ngx_http_script_complex_value_code(ngx_http_script_engine_t *e)
e->pos = e->buf.data;
e->end = e->buf.data + len;
e->sp->len = e->buf.len;
e->sp->data = e->buf.data;
e->sp++;
}
void
ngx_http_script_complex_value_end_code(ngx_http_script_engine_t *e)
{
ngx_http_variable_value_t *val;
val = e->sp - 1;
e->ip += sizeof(ngx_http_script_complex_value_end_code_t);
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, e->request->connection->log, 0,
"http script complex value end");
e->sp->len = e->pos - e->buf.data;
e->sp->data = e->buf.data;
e->sp++;
if (val->data == e->buf.data) {
val->len = e->pos - e->buf.data;
}
}