diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2015-02-24 18:37:14 +0300 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2015-02-24 18:37:14 +0300 |
| commit | 0071fbb9e6685b76a4865f460cb674020dfdf8ec (patch) | |
| tree | a9cf9badb9471cb8ad50a35679da49e02fc0c624 /src/core/ngx_hash.c | |
| parent | 06d72320ff5d5cd717b576920bc27c3e26329774 (diff) | |
| download | nginx-0071fbb9e6685b76a4865f460cb674020dfdf8ec.tar.gz nginx-0071fbb9e6685b76a4865f460cb674020dfdf8ec.tar.bz2 | |
Core: fixed potential buffer overrun when initializing hash.
Initial size as calculated from the number of elements may be bigger
than max_size. If this happens, make sure to set size to max_size.
Reported by Chris West.
Diffstat (limited to 'src/core/ngx_hash.c')
| -rw-r--r-- | src/core/ngx_hash.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/core/ngx_hash.c b/src/core/ngx_hash.c index 65ad83947..e707c0998 100644 --- a/src/core/ngx_hash.c +++ b/src/core/ngx_hash.c @@ -312,7 +312,7 @@ ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts) continue; } - size--; + size = hinit->max_size; ngx_log_error(NGX_LOG_WARN, hinit->pool->log, 0, "could not build optimal %s, you should increase " |