From 51aa6dec4df9767b10464373ddec3018d797837b Mon Sep 17 00:00:00 2001 From: Igor Sysoev Date: Tue, 3 Nov 2009 18:12:20 +0000 Subject: fix segfault if there is single large_client_header_buffers and a request line fills it completely --- src/http/ngx_http_request.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'src/http/ngx_http_request.c') diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index a0c4ea3b8..56eee2643 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -954,9 +954,17 @@ ngx_http_process_request_headers(ngx_event_t *rev) } if (rv == NGX_DECLINED) { - len = r->header_in->end - r->header_name_start; p = r->header_name_start; + if (p == NULL) { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent too large request"); + ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); + return; + } + + len = r->header_in->end - p; + if (len > NGX_MAX_ERROR_STR - 300) { len = NGX_MAX_ERROR_STR - 300; p[len++] = '.'; p[len++] = '.'; p[len++] = '.'; -- cgit