diff options
| author | Sergey Kandaurov <pluknet@nginx.com> | 2025-11-24 15:57:09 +0400 |
|---|---|---|
| committer | Sergey Kandaurov <s.kandaurov@f5.com> | 2025-11-26 22:46:22 +0400 |
| commit | bcb41c91939009b7d01074c9a8f3cef1da13ec50 (patch) | |
| tree | c2f7bde4caeccd9ca67dc337272e9530af430bd5 /src | |
| parent | 6446f99107fff83469145b16983ebec99261a2db (diff) | |
| download | nginx-bcb41c91939009b7d01074c9a8f3cef1da13ec50.tar.gz nginx-bcb41c91939009b7d01074c9a8f3cef1da13ec50.tar.bz2 | |
Proxy: fixed segfault in URI change.
If request URI was shorter than location prefix, as after replacement
with try_files, location length was used to copy the remaining URI part
leading to buffer overread.
The fix is to replace full request URI in this case. In the following
configuration, request "/123" is changed to "/" when sent to backend.
location /1234 {
try_files /123 =404;
proxy_pass http://127.0.0.1:8080/;
}
Closes #983 on GitHub.
Diffstat (limited to 'src')
| -rw-r--r-- | src/http/modules/ngx_http_proxy_module.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c index 8d5385c1d..d3836602e 100644 --- a/src/http/modules/ngx_http_proxy_module.c +++ b/src/http/modules/ngx_http_proxy_module.c @@ -1206,7 +1206,8 @@ ngx_http_proxy_create_key(ngx_http_request_t *r) return NGX_OK; } - loc_len = (r->valid_location && ctx->vars.uri.len) ? plcf->location.len : 0; + loc_len = (r->valid_location && ctx->vars.uri.len) + ? ngx_min(plcf->location.len, r->uri.len) : 0; if (r->quoted_uri || r->internal) { escape = 2 * ngx_escape_uri(NULL, r->uri.data + loc_len, @@ -1318,8 +1319,8 @@ ngx_http_proxy_create_request(ngx_http_request_t *r) uri_len = r->unparsed_uri.len; } else { - loc_len = (r->valid_location && ctx->vars.uri.len) ? - plcf->location.len : 0; + loc_len = (r->valid_location && ctx->vars.uri.len) + ? ngx_min(plcf->location.len, r->uri.len) : 0; if (r->quoted_uri || r->internal) { escape = 2 * ngx_escape_uri(NULL, r->uri.data + loc_len, |