Mercurial > hg > nginx-quic
annotate src/http/ngx_http_variables.h @ 4617:972642646f06
Rewrite: fixed escaping and possible segfault (ticket #162).
The following code resulted in incorrect escaping of uri and possible
segfault:
location / {
rewrite ^(.*) $1?c=$1;
return 200 "$uri";
}
If there were arguments in a rewrite's replacement string, and length was
actually calculated (due to duplicate captures as in the example above,
or variables present), the is_args flag was set and incorrectly copied
after length calculation. This resulted in escaping applied to the uri part
of the replacement, resulting in incorrect escaping. Additionally, buffer
was allocated without escaping expected, thus this also resulted in buffer
overrun and possible segfault.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Fri, 11 May 2012 13:19:22 +0000 |
parents | d620f497c50f |
children | a33b8c3aa975 |
rev | line source |
---|---|
499 | 1 |
2 /* | |
3 * Copyright (C) Igor Sysoev | |
4412 | 4 * Copyright (C) Nginx, Inc. |
499 | 5 */ |
6 | |
7 | |
8 #ifndef _NGX_HTTP_VARIABLES_H_INCLUDED_ | |
9 #define _NGX_HTTP_VARIABLES_H_INCLUDED_ | |
10 | |
11 | |
12 #include <ngx_config.h> | |
13 #include <ngx_core.h> | |
14 #include <ngx_http.h> | |
15 | |
16 | |
1310
33d6c994a0b2
Sun Studio on sparc uses different bit order
Igor Sysoev <igor@sysoev.ru>
parents:
1162
diff
changeset
|
17 typedef ngx_variable_value_t ngx_http_variable_value_t; |
499 | 18 |
2008
66dc85397a90
escape 0x00-0x1f, ", and \ in access log variables
Igor Sysoev <igor@sysoev.ru>
parents:
1565
diff
changeset
|
19 #define ngx_http_variable(v) { sizeof(v) - 1, 1, 0, 0, 0, (u_char *) v } |
573 | 20 |
499 | 21 typedef struct ngx_http_variable_s ngx_http_variable_t; |
22 | |
637 | 23 typedef void (*ngx_http_set_variable_pt) (ngx_http_request_t *r, |
24 ngx_http_variable_value_t *v, uintptr_t data); | |
573 | 25 typedef ngx_int_t (*ngx_http_get_variable_pt) (ngx_http_request_t *r, |
26 ngx_http_variable_value_t *v, uintptr_t data); | |
499 | 27 |
28 | |
1565 | 29 #define NGX_HTTP_VAR_CHANGEABLE 1 |
30 #define NGX_HTTP_VAR_NOCACHEABLE 2 | |
31 #define NGX_HTTP_VAR_INDEXED 4 | |
32 #define NGX_HTTP_VAR_NOHASH 8 | |
509 | 33 |
34 | |
499 | 35 struct ngx_http_variable_s { |
573 | 36 ngx_str_t name; /* must be first to build the hash */ |
637 | 37 ngx_http_set_variable_pt set_handler; |
38 ngx_http_get_variable_pt get_handler; | |
573 | 39 uintptr_t data; |
40 ngx_uint_t flags; | |
41 ngx_uint_t index; | |
499 | 42 }; |
43 | |
44 | |
501 | 45 ngx_http_variable_t *ngx_http_add_variable(ngx_conf_t *cf, ngx_str_t *name, |
509 | 46 ngx_uint_t flags); |
47 ngx_int_t ngx_http_get_variable_index(ngx_conf_t *cf, ngx_str_t *name); | |
499 | 48 ngx_http_variable_value_t *ngx_http_get_indexed_variable(ngx_http_request_t *r, |
49 ngx_uint_t index); | |
573 | 50 ngx_http_variable_value_t *ngx_http_get_flushed_variable(ngx_http_request_t *r, |
51 ngx_uint_t index); | |
52 | |
499 | 53 ngx_http_variable_value_t *ngx_http_get_variable(ngx_http_request_t *r, |
3500
0eb46e3c5c02
change processing variables accessed by SSI and perl module:
Igor Sysoev <igor@sysoev.ru>
parents:
3356
diff
changeset
|
54 ngx_str_t *name, ngx_uint_t key); |
509 | 55 |
1162 | 56 ngx_int_t ngx_http_variable_unknown_header(ngx_http_variable_value_t *v, |
57 ngx_str_t *var, ngx_list_part_t *part, size_t prefix); | |
58 | |
59 | |
573 | 60 #define ngx_http_clear_variable(r, index) r->variables0[index].text.data = NULL; |
61 | |
62 | |
3356
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
63 #if (NGX_PCRE) |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
64 |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
65 typedef struct { |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
66 ngx_uint_t capture; |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
67 ngx_int_t index; |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
68 } ngx_http_regex_variable_t; |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
69 |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
70 |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
71 typedef struct { |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
72 ngx_regex_t *regex; |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
73 ngx_uint_t ncaptures; |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
74 ngx_http_regex_variable_t *variables; |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
75 ngx_uint_t nvariables; |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
76 ngx_str_t name; |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
77 } ngx_http_regex_t; |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
78 |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
79 |
3872
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
80 typedef struct { |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
81 ngx_http_regex_t *regex; |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
82 void *value; |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
83 } ngx_http_map_regex_t; |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
84 |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
85 |
3325 | 86 ngx_http_regex_t *ngx_http_regex_compile(ngx_conf_t *cf, |
87 ngx_regex_compile_t *rc); | |
88 ngx_int_t ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, | |
89 ngx_str_t *s); | |
90 | |
3356
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
91 #endif |
fe08c14530e9
fix building without PCRE, the bug had been introduced in r3326
Igor Sysoev <igor@sysoev.ru>
parents:
3325
diff
changeset
|
92 |
3325 | 93 |
3872
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
94 typedef struct { |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
95 ngx_hash_combined_t hash; |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
96 #if (NGX_PCRE) |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
97 ngx_http_map_regex_t *regex; |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
98 ngx_uint_t nregex; |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
99 #endif |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
100 } ngx_http_map_t; |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
101 |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
102 |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
103 void *ngx_http_map_find(ngx_http_request_t *r, ngx_http_map_t *map, |
3929
fa4612bfb9fa
change ngx_http_map_find(): use case sensitive regexes
Igor Sysoev <igor@sysoev.ru>
parents:
3872
diff
changeset
|
104 ngx_str_t *match); |
3872
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
105 |
83cd1910329c
allow regex as "map" parameter
Igor Sysoev <igor@sysoev.ru>
parents:
3641
diff
changeset
|
106 |
509 | 107 ngx_int_t ngx_http_variables_add_core_vars(ngx_conf_t *cf); |
108 ngx_int_t ngx_http_variables_init_vars(ngx_conf_t *cf); | |
499 | 109 |
110 | |
577 | 111 extern ngx_http_variable_value_t ngx_http_variable_null_value; |
112 extern ngx_http_variable_value_t ngx_http_variable_true_value; | |
113 | |
114 | |
499 | 115 #endif /* _NGX_HTTP_VARIABLES_H_INCLUDED_ */ |