From f8a23425bd6840c4c36b4264edf576ba3646156f Mon Sep 17 00:00:00 2001 From: Roman Arutyunyan Date: Fri, 10 Jul 2026 20:10:12 +0400 Subject: [PATCH] Avoid post-rewrite URI to path mapping with alias Previously, after a "rewrite" had changed the URI, and before a new location was chosen, the new URI might not match the current location prefix. This becomes a problem when the location uses "alias", which is why normally such inconsistency is detected by checking the r->valid_location flag. Meanwhile this flag only handles the inconsistency when using the "break" directive or parameter. However in absence of those, there's still an inconsistency window from URI change up until the end of the current set of rewrite directives. URI to path mapping within this window might result in a buffer overflow if location's prefix was longer than the rewritten URI. The following example resulted in a buffer overflow with the request "/foo/1": location /foo/ { alias /bar/; rewrite ^/foo/.*$ /x; return 200 $request_filename; } Alternatively, $request_filename might be used in access log format, "set", "if", "add_header", etc. The fix is to reject URI mapping in ngx_http_map_uri_to_path() if the r->uri_changed flag is set. --- src/http/ngx_http_core_module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c index 380ee21b2..30ae6e0ec 100644 --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -1987,7 +1987,7 @@ ngx_http_map_uri_to_path(ngx_http_request_t *r, ngx_str_t *path, alias = clcf->alias; - if (alias && !r->valid_location) { + if (alias && (!r->valid_location || r->uri_changed)) { ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0, "\"alias\" cannot be used in location \"%V\" " "where URI was rewritten", &clcf->name);