diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2026-03-16 20:13:03 +0400 |
|---|---|---|
| committer | Roman Arutyunyan <arutyunyan.roman@gmail.com> | 2026-03-24 22:33:23 +0400 |
| commit | a1d18284e0a173c4ef2b28425535d0f640ae0a82 (patch) | |
| tree | 48a4139f8c509c2f6c442af4c789b04e897f5afb /src/misc/ngx_cpp_test_module.cpp | |
| parent | b23ac73b00313d159a99636c21ef71b828781018 (diff) | |
| download | nginx-a1d18284e0a173c4ef2b28425535d0f640ae0a82.tar.gz nginx-a1d18284e0a173c4ef2b28425535d0f640ae0a82.tar.bz2 | |
Dav: destination length validation for COPY and MOVE.
Previously, when alias was used in a location with Dav COPY or MOVE
enabled, and the destination URI was shorter than the alias, integer
underflow could happen in ngx_http_map_uri_to_path(), which could
result in heap buffer overwrite, followed by a possible segfault.
With some implementations of memcpy(), the segfault could be avoided
and the overwrite could result in a change of the source or destination
file names to be outside of the location root.
Reported by Calif.io in collaboration with Claude and Anthropic Research.
Diffstat (limited to 'src/misc/ngx_cpp_test_module.cpp')
0 files changed, 0 insertions, 0 deletions