Mercurial > hg > nginx-quic
annotate src/stream/ngx_stream_variables.h @ 7054:e02555553d0b
Range filter: protect from total size overflows.
The overflow can be used to circumvent the restriction on total size of
ranges introduced in c2a91088b0c0 (1.1.2). Additionally, overflow
allows producing ranges with negative start (such ranges can be created
by using a suffix, "bytes=-100"; normally this results in 200 due to
the total size check). These can result in the following errors in logs:
[crit] ... pread() ... failed (22: Invalid argument)
[alert] ... sendfile() failed (22: Invalid argument)
When using cache, it can be also used to reveal cache file header.
It is believed that there are no other negative effects, at least with
standard nginx modules.
In theory, this can also result in memory disclosure and/or segmentation
faults if multiple ranges are allowed, and the response is returned in a
single in-memory buffer. This never happens with standard nginx modules
though, as well as known 3rd party modules.
Fix is to properly protect from possible overflow when incrementing size.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Tue, 11 Jul 2017 16:06:23 +0300 |
parents | d2b2ff157da5 |
children | 2a288909abc6 |
rev | line source |
---|---|
6607 | 1 |
2 /* | |
3 * Copyright (C) Igor Sysoev | |
4 * Copyright (C) Nginx, Inc. | |
5 */ | |
6 | |
7 | |
8 #ifndef _NGX_STREAM_VARIABLES_H_INCLUDED_ | |
9 #define _NGX_STREAM_VARIABLES_H_INCLUDED_ | |
10 | |
11 | |
12 #include <ngx_config.h> | |
13 #include <ngx_core.h> | |
14 #include <ngx_stream.h> | |
15 | |
16 | |
17 typedef ngx_variable_value_t ngx_stream_variable_value_t; | |
18 | |
19 #define ngx_stream_variable(v) { sizeof(v) - 1, 1, 0, 0, 0, (u_char *) v } | |
20 | |
21 typedef struct ngx_stream_variable_s ngx_stream_variable_t; | |
22 | |
23 typedef void (*ngx_stream_set_variable_pt) (ngx_stream_session_t *s, | |
24 ngx_stream_variable_value_t *v, uintptr_t data); | |
25 typedef ngx_int_t (*ngx_stream_get_variable_pt) (ngx_stream_session_t *s, | |
26 ngx_stream_variable_value_t *v, uintptr_t data); | |
27 | |
28 | |
29 #define NGX_STREAM_VAR_CHANGEABLE 1 | |
30 #define NGX_STREAM_VAR_NOCACHEABLE 2 | |
31 #define NGX_STREAM_VAR_INDEXED 4 | |
32 #define NGX_STREAM_VAR_NOHASH 8 | |
6899
d2b2ff157da5
Variables: generic prefix variables.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6607
diff
changeset
|
33 #define NGX_STREAM_VAR_WEAK 16 |
d2b2ff157da5
Variables: generic prefix variables.
Dmitry Volyntsev <xeioex@nginx.com>
parents:
6607
diff
changeset
|
34 #define NGX_STREAM_VAR_PREFIX 32 |
6607 | 35 |
36 | |
37 struct ngx_stream_variable_s { | |
38 ngx_str_t name; /* must be first to build the hash */ | |
39 ngx_stream_set_variable_pt set_handler; | |
40 ngx_stream_get_variable_pt get_handler; | |
41 uintptr_t data; | |
42 ngx_uint_t flags; | |
43 ngx_uint_t index; | |
44 }; | |
45 | |
46 | |
47 ngx_stream_variable_t *ngx_stream_add_variable(ngx_conf_t *cf, ngx_str_t *name, | |
48 ngx_uint_t flags); | |
49 ngx_int_t ngx_stream_get_variable_index(ngx_conf_t *cf, ngx_str_t *name); | |
50 ngx_stream_variable_value_t *ngx_stream_get_indexed_variable( | |
51 ngx_stream_session_t *s, ngx_uint_t index); | |
52 ngx_stream_variable_value_t *ngx_stream_get_flushed_variable( | |
53 ngx_stream_session_t *s, ngx_uint_t index); | |
54 | |
55 ngx_stream_variable_value_t *ngx_stream_get_variable(ngx_stream_session_t *s, | |
56 ngx_str_t *name, ngx_uint_t key); | |
57 | |
58 | |
59 #if (NGX_PCRE) | |
60 | |
61 typedef struct { | |
62 ngx_uint_t capture; | |
63 ngx_int_t index; | |
64 } ngx_stream_regex_variable_t; | |
65 | |
66 | |
67 typedef struct { | |
68 ngx_regex_t *regex; | |
69 ngx_uint_t ncaptures; | |
70 ngx_stream_regex_variable_t *variables; | |
71 ngx_uint_t nvariables; | |
72 ngx_str_t name; | |
73 } ngx_stream_regex_t; | |
74 | |
75 | |
76 typedef struct { | |
77 ngx_stream_regex_t *regex; | |
78 void *value; | |
79 } ngx_stream_map_regex_t; | |
80 | |
81 | |
82 ngx_stream_regex_t *ngx_stream_regex_compile(ngx_conf_t *cf, | |
83 ngx_regex_compile_t *rc); | |
84 ngx_int_t ngx_stream_regex_exec(ngx_stream_session_t *s, ngx_stream_regex_t *re, | |
85 ngx_str_t *str); | |
86 | |
87 #endif | |
88 | |
89 | |
90 typedef struct { | |
91 ngx_hash_combined_t hash; | |
92 #if (NGX_PCRE) | |
93 ngx_stream_map_regex_t *regex; | |
94 ngx_uint_t nregex; | |
95 #endif | |
96 } ngx_stream_map_t; | |
97 | |
98 | |
99 void *ngx_stream_map_find(ngx_stream_session_t *s, ngx_stream_map_t *map, | |
100 ngx_str_t *match); | |
101 | |
102 | |
103 ngx_int_t ngx_stream_variables_add_core_vars(ngx_conf_t *cf); | |
104 ngx_int_t ngx_stream_variables_init_vars(ngx_conf_t *cf); | |
105 | |
106 | |
107 extern ngx_stream_variable_value_t ngx_stream_variable_null_value; | |
108 extern ngx_stream_variable_value_t ngx_stream_variable_true_value; | |
109 | |
110 | |
111 #endif /* _NGX_STREAM_VARIABLES_H_INCLUDED_ */ |