From 6aa4b3fdd4fdc156153f2981eb4070690624447c Mon Sep 17 00:00:00 2001 From: Roman Arutyunyan Date: Wed, 29 Jul 2026 16:57:59 +0400 Subject: [PATCH] Script: reserved memory overrun protection in ngx_http_script_run() In b76754049 buffer overrun protection in script was introduced. However in ngx_http_script_run() data could still spill over to the reserved area. This had no visible effects except the return value which could extend beyond the maximum formatted string size. This value is however currently unused in the nginx code. Later in a8289aa69 string length recalculation was implemented to protect against buffer underwrite. Considering a possible spillover to the reserved area, the final string size could become larger than the allocated buffer size. This could later result in writing beyond the buffer boundaries. Maximum buffer overflow is the size of the reserved area. This could affect calculating document root from variables in HTTP or using access logging in HTTP or Stream. In the case of access logging a possible impact is limited by an off-by-one write of a null byte. Reported by Matt Suiche of Tolmo Inc. --- src/http/ngx_http_script.c | 6 +++--- src/stream/ngx_stream_script.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c index 6d41cc720..2f14b3500 100644 --- a/src/http/ngx_http_script.c +++ b/src/http/ngx_http_script.c @@ -645,7 +645,7 @@ ngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value, e.request = r; e.flushed = 1; - n = len; + n = 0; while (*(uintptr_t *) e.ip) { lcode = *(ngx_http_script_len_code_pt *) e.ip; @@ -653,8 +653,8 @@ ngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value, } - value->len = n; - value->data = ngx_pnalloc(r->pool, n); + value->len = n + len; + value->data = ngx_pnalloc(r->pool, n + len); if (value->data == NULL) { return NULL; } diff --git a/src/stream/ngx_stream_script.c b/src/stream/ngx_stream_script.c index 54e5dd559..4ae10d5ce 100644 --- a/src/stream/ngx_stream_script.c +++ b/src/stream/ngx_stream_script.c @@ -521,7 +521,7 @@ ngx_stream_script_run(ngx_stream_session_t *s, ngx_str_t *value, e.session = s; e.flushed = 1; - n = len; + n = 0; while (*(uintptr_t *) e.ip) { lcode = *(ngx_stream_script_len_code_pt *) e.ip; @@ -529,8 +529,8 @@ ngx_stream_script_run(ngx_stream_session_t *s, ngx_str_t *value, } - value->len = n; - value->data = ngx_pnalloc(s->connection->pool, n); + value->len = n + len; + value->data = ngx_pnalloc(s->connection->pool, n + len); if (value->data == NULL) { return NULL; }