From aa04b091aecd11e97563f4835fc3b4a353deedf8 Mon Sep 17 00:00:00 2001 From: Sergey Kandaurov Date: Wed, 7 Jun 2017 18:46:36 +0300 Subject: Userid: ngx_http_get_indexed_variable() error handling. When evaluating a mapped $reset_uid variable in the userid filter, if get_handler set to ngx_http_map_variable() returned an error, this previously resulted in a NULL pointer dereference. --- src/http/modules/ngx_http_userid_filter_module.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src') diff --git a/src/http/modules/ngx_http_userid_filter_module.c b/src/http/modules/ngx_http_userid_filter_module.c index 0dbacba08..a1a54936b 100644 --- a/src/http/modules/ngx_http_userid_filter_module.c +++ b/src/http/modules/ngx_http_userid_filter_module.c @@ -472,6 +472,10 @@ ngx_http_userid_create_uid(ngx_http_request_t *r, ngx_http_userid_ctx_t *ctx, vv = ngx_http_get_indexed_variable(r, ngx_http_userid_reset_index); + if (vv == NULL || vv->not_found) { + return NGX_ERROR; + } + if (vv->len == 0 || (vv->len == 1 && vv->data[0] == '0')) { if (conf->mark == '\0' -- cgit