IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-07-29 15:54:27 -05:00
Code Issues Packages Projects Releases Wiki Activity

Stream: fixed handling of non-ssl sessions.

Browse Source 
A missing check could cause ngx_stream_ssl_handler() to be applied
to a non-ssl session, which resulted in a null pointer dereference
if ssl_verify_client is enabled.

The bug had appeared in 1.11.8 (41cb1b64561d).
This commit is contained in:
Vladimir Homutov
2017-01-19 16:17:05 +03:00
parent b5a3cc3781
commit 0ccbe0abe4
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/stream/ngx_stream_ssl_module.c
+5 -1
View File
@@ -287,11 +287,15 @@ ngx_stream_ssl_handler(ngx_stream_session_t *s)
ngx_connection_t *c;
ngx_stream_ssl_conf_t *sslcf;
if (!s->ssl) {
return NGX_OK;
}
c = s->connection;
sslcf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_module);
if (s->ssl && c->ssl == NULL) {
if (c->ssl == NULL) {
c->log->action = "SSL handshaking";
if (sslcf->ssl.ctx == NULL) {