diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2026-03-16 20:13:03 +0400 |
|---|---|---|
| committer | Roman Arutyunyan <arutyunyan.roman@gmail.com> | 2026-03-24 18:45:25 +0400 |
| commit | 9739e755b8dddba82e65ca2a08d079f4c9826b75 (patch) | |
| tree | 663b0068362ccda8747bcbae6d8728072b3b8ea1 /src/http/modules/ngx_http_auth_request_module.c | |
| parent | 3568812cf98dfd7661cd7516ecf9b398c134ab3c (diff) | |
| download | nginx-9739e755b8dddba82e65ca2a08d079f4c9826b75.tar.gz nginx-9739e755b8dddba82e65ca2a08d079f4c9826b75.tar.bz2 | |
Dav: destination length validation for COPY and MOVE.
Previously, when alias was used in a location with Dav COPY or MOVE
enabled, and the destination URI was shorter than the alias, integer
underflow could happen in ngx_http_map_uri_to_path(), which could
result in heap buffer overwrite, followed by a possible segfault.
With some implementations of memcpy(), the segfault could be avoided
and the overwrite could result in a change of the source or destination
file names to be outside of the location root.
Reported by Calif.io in collaboration with Claude and Anthropic Research.
Diffstat (limited to 'src/http/modules/ngx_http_auth_request_module.c')
0 files changed, 0 insertions, 0 deletions