mirror of
https://github.com/nginx/nginx.git
synced 2026-10-24 22:57:43 -05:00
Script: improved compatibility of complex value codes
In a8289aa69c, we introduced a new code to finalize the evaluation of
a complex value, deferring the stack update to this new code. However,
the change inadvertently broke compatibility with several third-party
modules that were reusing ngx_http_script_complex_value_code.
This change relegates omitted ngx_http_script_complex_value_end_code
from crash to a potential read of uninitialized bytes at the end of the
allocated buffer.
This commit is contained in:
1 parent
a18b3f170c
commit
f496c50c51
1 file changed
+11
-3
@@ -1867,20 +1867,28 @@ ngx_http_script_complex_value_code(ngx_http_script_engine_t *e)
|
||||
|
||||
e->pos = e->buf.data;
|
||||
e->end = e->buf.data + len;
|
||||
|
||||
e->sp->len = e->buf.len;
|
||||
e->sp->data = e->buf.data;
|
||||
e->sp++;
|
||||
}
|
||||
|
||||
|
||||
void
|
||||
ngx_http_script_complex_value_end_code(ngx_http_script_engine_t *e)
|
||||
{
|
||||
ngx_http_variable_value_t *val;
|
||||
|
||||
val = e->sp - 1;
|
||||
|
||||
e->ip += sizeof(ngx_http_script_complex_value_end_code_t);
|
||||
|
||||
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, e->request->connection->log, 0,
|
||||
"http script complex value end");
|
||||
|
||||
e->sp->len = e->pos - e->buf.data;
|
||||
e->sp->data = e->buf.data;
|
||||
e->sp++;
|
||||
if (val->data == e->buf.data) {
|
||||
val->len = e->pos - e->buf.data;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
Reference in new issue
Block a user