diff options
| author | Ruslan Ermilov <ru@nginx.com> | 2012-04-26 12:58:42 +0000 |
|---|---|---|
| committer | Ruslan Ermilov <ru@nginx.com> | 2012-04-26 12:58:42 +0000 |
| commit | 487ba70126ddcde8f889e20617b927c9d716c792 (patch) | |
| tree | f65b1792ca8fddac32765dbd5ac93006494aaa64 /src/core/ngx_resolver.c | |
| parent | 6ad02389c3947f8af2ce295d83e4c27427c9b644 (diff) | |
| download | nginx-487ba70126ddcde8f889e20617b927c9d716c792.tar.gz nginx-487ba70126ddcde8f889e20617b927c9d716c792.tar.bz2 | |
Fixed segmentation fault in ngx_resolver_create_name_query().
If name passed for resolution was { 0, NULL } (e.g. as a result
of name server returning CNAME pointing to ".") pointer wrapped
to (void *) -1 resulting in segmentation fault on an attempt to
dereference it.
Reported by Lanshun Zhou.
Diffstat (limited to 'src/core/ngx_resolver.c')
| -rw-r--r-- | src/core/ngx_resolver.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/core/ngx_resolver.c b/src/core/ngx_resolver.c index 02c484da6..ecf97d7f7 100644 --- a/src/core/ngx_resolver.c +++ b/src/core/ngx_resolver.c @@ -1834,6 +1834,10 @@ ngx_resolver_create_name_query(ngx_resolver_node_t *rn, ngx_resolver_ctx_t *ctx) p--; *p-- = '\0'; + if (ctx->name.len == 0) { + return NGX_DECLINED; + } + for (s = ctx->name.data + ctx->name.len - 1; s >= ctx->name.data; s--) { if (*s != '.') { *p = *s; |