diff options
| author | Sergey Kandaurov <pluknet@nginx.com> | 2025-11-24 15:57:09 +0400 |
|---|---|---|
| committer | Sergey Kandaurov <s.kandaurov@f5.com> | 2025-12-23 22:40:33 +0400 |
| commit | eec047c936347bb1ebb6266a4c83f31fa9c78e24 (patch) | |
| tree | 5e78c00e4421c5fc34d8dc2c97fe622b9d20c9d9 /src/http/modules | |
| parent | 2b502468588835e479fcd76a2cc0d00394f2c32c (diff) | |
| download | nginx-eec047c936347bb1ebb6266a4c83f31fa9c78e24.tar.gz nginx-eec047c936347bb1ebb6266a4c83f31fa9c78e24.tar.bz2 | |
Proxy: fixed segfault in URI change.
If request URI was shorter than location prefix, as after replacement
with try_files, location length was used to copy the remaining URI part
leading to buffer overread.
The fix is to replace full request URI in this case. In the following
configuration, request "/123" is changed to "/" when sent to backend.
location /1234 {
try_files /123 =404;
proxy_pass http://127.0.0.1:8080/;
}
Closes #983 on GitHub.
Diffstat (limited to 'src/http/modules')
| -rw-r--r-- | src/http/modules/ngx_http_proxy_module.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c index 7ee5ff3e8..0778ec728 100644 --- a/src/http/modules/ngx_http_proxy_module.c +++ b/src/http/modules/ngx_http_proxy_module.c @@ -1206,7 +1206,8 @@ ngx_http_proxy_create_key(ngx_http_request_t *r) return NGX_OK; } - loc_len = (r->valid_location && ctx->vars.uri.len) ? plcf->location.len : 0; + loc_len = (r->valid_location && ctx->vars.uri.len) + ? ngx_min(plcf->location.len, r->uri.len) : 0; if (r->quoted_uri || r->internal) { escape = 2 * ngx_escape_uri(NULL, r->uri.data + loc_len, @@ -1318,8 +1319,8 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) uri_len = r->unparsed_uri.len; } else { - loc_len = (r->valid_location && ctx->vars.uri.len) ? - plcf->location.len : 0; + loc_len = (r->valid_location && ctx->vars.uri.len) + ? ngx_min(plcf->location.len, r->uri.len) : 0; if (r->quoted_uri || r->internal) { escape = 2 * ngx_escape_uri(NULL, r->uri.data + loc_len, |