IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-12-19 05:33:52 -06:00
Code Issues Packages Projects Releases Wiki Activity

Dav: ngx_http_map_uri_to_path() errors were not checked.

Browse Source 
Once error occured, it could lead to use uninitialized variables to log,
even more segmentation fault.
This commit is contained in:
FengGu 2014-07-30 14:45:08 +08:00
parent a176d17222
commit bfa56738af
1 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/http/modules/ngx_http_dav_module.c
View File

@ -212,7 +212,10 @@ ngx_http_dav_put_handler(ngx_http_request_t *r)
return; return;
} }
ngx_http_map_uri_to_path(r, &path, &root, 0); if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {
ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
return;
}
path.len--; path.len--;
@ -320,7 +323,9 @@ ngx_http_dav_delete_handler(ngx_http_request_t *r)
ok: ok:
ngx_http_map_uri_to_path(r, &path, &root, 0); if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {
return NGX_HTTP_INTERNAL_SERVER_ERROR;
}
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
"http delete filename: \"%s\"", path.data); "http delete filename: \"%s\"", path.data);
@ -488,6 +493,9 @@ ngx_http_dav_mkcol_handler(ngx_http_request_t *r, ngx_http_dav_loc_conf_t *dlcf)
} }
p = ngx_http_map_uri_to_path(r, &path, &root, 0); p = ngx_http_map_uri_to_path(r, &path, &root, 0);
if (p == NULL) {
return NGX_HTTP_INTERNAL_SERVER_ERROR;
}
*(p - 1) = '\0'; *(p - 1) = '\0';
r->uri.len--; r->uri.len--;
@ -666,7 +674,9 @@ destination_done:
overwrite_done: overwrite_done:
ngx_http_map_uri_to_path(r, &path, &root, 0); if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {
return NGX_HTTP_INTERNAL_SERVER_ERROR;
}
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
"http copy from: \"%s\"", path.data); "http copy from: \"%s\"", path.data);
@ -674,7 +684,9 @@ overwrite_done:
uri = r->uri; uri = r->uri;
r->uri = duri; r->uri = duri;
ngx_http_map_uri_to_path(r, &copy.path, &root, 0); if (ngx_http_map_uri_to_path(r, &copy.path, &root, 0) == NULL) {
return NGX_HTTP_INTERNAL_SERVER_ERROR;
}
r->uri = uri; r->uri = uri;