diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2012-03-15 11:41:43 +0000 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2012-03-15 11:41:43 +0000 |
| commit | 44eade9c1df4ef009d9fcd7721d8e4c34370ca1d (patch) | |
| tree | 8be1916c9f4d828004ce934a83d0d97207cd327a /src/http/ngx_http_variables.c | |
| parent | 6dbc33f8317e2a7a9596351f48f7914b5450779b (diff) | |
| download | nginx-44eade9c1df4ef009d9fcd7721d8e4c34370ca1d.tar.gz nginx-44eade9c1df4ef009d9fcd7721d8e4c34370ca1d.tar.bz2 | |
Merge of r4530, r4531: null character fixes.
*) Fixed incorrect ngx_cpystrn() usage in ngx_http_*_process_header().
This resulted in a disclosure of previously freed memory if upstream
server returned specially crafted response, potentially exposing
sensitive information.
Reported by Matthew Daley.
*) Headers with null character are now rejected.
Headers with NUL character aren't allowed by HTTP standard and may cause
various security problems. They are now unconditionally rejected.
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions