IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-12-18 21:23:36 -06:00
Code Issues Packages Projects Releases Wiki Activity

Added protection against r->main->count overflow by subrequests.

Browse Source 
This overflow has become possible after the change in 06e850859a26,
since concurrent subrequests are not limited now and each of them is
counted in r->main->count.
This commit is contained in:
Valentin Bartenev 2015-08-31 23:25:16 +03:00
parent 0d3b15729c
commit 4ec67cf86f
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/http/ngx_http_core_module.c
View File

@ -2433,6 +2433,16 @@ ngx_http_subrequest(ngx_http_request_t *r,
return NGX_ERROR;
}
/*
* 1000 is reserved for other purposes.
*/
if (r->main->count >= 65535 - 1000) {
ngx_log_error(NGX_LOG_CRIT, r->connection->log, 0,
"request reference counter overflow "
"while processing \"%V\"", uri);
return NGX_ERROR;
}
sr = ngx_pcalloc(r->pool, sizeof(ngx_http_request_t));
if (sr == NULL) {
return NGX_ERROR;

2
src/http/ngx_http_request.h
View File

@ -439,8 +439,8 @@ struct ngx_http_request_s {
ngx_http_cleanup_t *cleanup;
unsigned count:16;
unsigned subrequests:8;
unsigned count:8;
unsigned blocked:8;
unsigned aio:1;