IntenseWebs/nginx
3
0 Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-10-24 22:57:43 -05:00
Code Issues Packages Projects Releases Wiki Activity

Add missing bounds check in ngx_{http,stream}_compile_complex_value()

Browse Source 
Complex value compilation scans strings for $1..$9 capture references.
Check that a byte after '$' is present before testing it, matching
ngx_str_t length semantics and avoiding reliance on NUL termination.

Apply the same check to both HTTP and stream implementations.
This commit is contained in:
Feng Wu authored and Sergey Kandaurov committed 2026-10-02 18:33:28 +04:00
1 parent e01a269f97
commit 37362244dc
2 files changed
+6 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/http/ngx_http_script.c
+3 -1
View File
@@ -156,7 +156,9 @@ ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
for (i = 0; i < v->len; i++) {
if (v->data[i] == '$') {
if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {
if (i + 1 < v->len
&& v->data[i + 1] >= '1' && v->data[i + 1] <= '9')
{
nc++;
} else {
src/stream/ngx_stream_script.c
+3 -1
View File
@@ -157,7 +157,9 @@ ngx_stream_compile_complex_value(ngx_stream_compile_complex_value_t *ccv)
for (i = 0; i < v->len; i++) {
if (v->data[i] == '$') {
if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {
if (i + 1 < v->len
&& v->data[i + 1] >= '1' && v->data[i + 1] <= '9')
{
nc++;
} else {