Mercurial > hg > nginx
annotate src/event/ngx_event_connect.h @ 9322:d6f75dd66761 default tip
Mp4: added and updated sanity checks for "end" handling.
When handling incorrect data in ngx_http_mp4_crop_stsc_data(),
trak->end_chunk_samples might end up being arbitrary large, leading
to reading before the buffer in ngx_http_mp4_update_stsz_atom(). Fix
is to check that trak->end_chunk_samples corresponds to a memory within
the stsz atom data. For consistency, trak->start_chunk_samples
is checked similarly.
Similarly, trak->end_chunk might end up being smaller than trak->start_chunk,
leading to reading memory after the buffer in ngx_http_mp4_update_stco_atom()
and ngx_http_mp4_update_co64_atom(). Corresponding checks are updated
to explicitly test (trak->end_chunk - trak->start_chunk) instead of just
checking trak->end_chunk and assuming it is larger than trak->start_chunk.
This is generally in line with existing checks of
(trak->end_sample - trak->start_sample) in ngx_http_mp4_update_stsz_atom(),
where trak->end_sample might also become smaller than trak->start_sample
when handling incorrect data in ngx_http_mp4_crop_stts_data().
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Sun, 25 Aug 2024 06:35:40 +0300 |
parents | 570d8c626eea |
children |
rev | line source |
---|---|
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
419
diff
changeset
|
1 |
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
419
diff
changeset
|
2 /* |
444
42d11f017717
nginx-0.1.0-2004-09-29-20:00:49 import; remove years from copyright
Igor Sysoev <igor@sysoev.ru>
parents:
441
diff
changeset
|
3 * Copyright (C) Igor Sysoev |
4412 | 4 * Copyright (C) Nginx, Inc. |
441
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
419
diff
changeset
|
5 */ |
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
419
diff
changeset
|
6 |
da8c5707af39
nginx-0.1.0-2004-09-28-12:34:51 import; set copyright and remove unused files
Igor Sysoev <igor@sysoev.ru>
parents:
419
diff
changeset
|
7 |
86
3973260705cc
nginx-0.0.1-2003-05-12-19:52:24 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
8 #ifndef _NGX_EVENT_CONNECT_H_INCLUDED_ |
3973260705cc
nginx-0.0.1-2003-05-12-19:52:24 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
9 #define _NGX_EVENT_CONNECT_H_INCLUDED_ |
3973260705cc
nginx-0.0.1-2003-05-12-19:52:24 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
10 |
3973260705cc
nginx-0.0.1-2003-05-12-19:52:24 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
11 |
3973260705cc
nginx-0.0.1-2003-05-12-19:52:24 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
12 #include <ngx_config.h> |
119
cd54bcbaf3b5
nginx-0.0.1-2003-07-21-01:15:59 import
Igor Sysoev <igor@sysoev.ru>
parents:
86
diff
changeset
|
13 #include <ngx_core.h> |
86
3973260705cc
nginx-0.0.1-2003-05-12-19:52:24 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
14 #include <ngx_event.h> |
3973260705cc
nginx-0.0.1-2003-05-12-19:52:24 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
15 |
3973260705cc
nginx-0.0.1-2003-05-12-19:52:24 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
16 |
1284
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
17 #define NGX_PEER_KEEPALIVE 1 |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
18 #define NGX_PEER_NEXT 2 |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
19 #define NGX_PEER_FAILED 4 |
884 | 20 |
21 | |
22 typedef struct ngx_peer_connection_s ngx_peer_connection_t; | |
23 | |
24 typedef ngx_int_t (*ngx_event_get_peer_pt)(ngx_peer_connection_t *pc, | |
25 void *data); | |
26 typedef void (*ngx_event_free_peer_pt)(ngx_peer_connection_t *pc, void *data, | |
27 ngx_uint_t state); | |
6707
1c9863f9592e
Modules compatibility: peer.notify.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6698
diff
changeset
|
28 typedef void (*ngx_event_notify_peer_pt)(ngx_peer_connection_t *pc, |
1c9863f9592e
Modules compatibility: peer.notify.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6698
diff
changeset
|
29 void *data, ngx_uint_t type); |
1284
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
30 typedef ngx_int_t (*ngx_event_set_peer_session_pt)(ngx_peer_connection_t *pc, |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
31 void *data); |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
32 typedef void (*ngx_event_save_peer_session_pt)(ngx_peer_connection_t *pc, |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
33 void *data); |
884 | 34 |
119
cd54bcbaf3b5
nginx-0.0.1-2003-07-21-01:15:59 import
Igor Sysoev <igor@sysoev.ru>
parents:
86
diff
changeset
|
35 |
884 | 36 struct ngx_peer_connection_s { |
1284
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
37 ngx_connection_t *connection; |
884 | 38 |
1284
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
39 struct sockaddr *sockaddr; |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
40 socklen_t socklen; |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
41 ngx_str_t *name; |
884 | 42 |
1284
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
43 ngx_uint_t tries; |
5832
d09b689911ac
Upstream: limited next_upstream time and tries (ticket #544).
Roman Arutyunyan <arut@nginx.com>
parents:
4412
diff
changeset
|
44 ngx_msec_t start_time; |
884 | 45 |
1284
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
46 ngx_event_get_peer_pt get; |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
47 ngx_event_free_peer_pt free; |
6707
1c9863f9592e
Modules compatibility: peer.notify.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6698
diff
changeset
|
48 ngx_event_notify_peer_pt notify; |
1284
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
49 void *data; |
884 | 50 |
6735
e38e9c50a40e
Modules compatibility: compatibility with NGX_HTTP_SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6715
diff
changeset
|
51 #if (NGX_SSL || NGX_COMPAT) |
1284
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
52 ngx_event_set_peer_session_pt set_session; |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
53 ngx_event_save_peer_session_pt save_session; |
377
41437e4fd9b4
nginx-0.0.7-2004-07-05-19:08:23 import
Igor Sysoev <igor@sysoev.ru>
parents:
288
diff
changeset
|
54 #endif |
120
b776ad95d96d
nginx-0.0.1-2003-07-21-20:24:25 import
Igor Sysoev <igor@sysoev.ru>
parents:
119
diff
changeset
|
55 |
3271
fcd98af88df3
proxy_bind, fastcgi_bind, and memcached_bind
Igor Sysoev <igor@sysoev.ru>
parents:
3264
diff
changeset
|
56 ngx_addr_t *local; |
fcd98af88df3
proxy_bind, fastcgi_bind, and memcached_bind
Igor Sysoev <igor@sysoev.ru>
parents:
3264
diff
changeset
|
57 |
6436 | 58 int type; |
1284
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
59 int rcvbuf; |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
60 |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
61 ngx_log_t *log; |
124
842a78cebbb7
nginx-0.0.1-2003-08-01-18:56:33 import
Igor Sysoev <igor@sysoev.ru>
parents:
121
diff
changeset
|
62 |
1284
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
63 unsigned cached:1; |
6530
1d0e03db9f8e
Upstream: the "transparent" parameter of proxy_bind and friends.
Roman Arutyunyan <arut@nginx.com>
parents:
6436
diff
changeset
|
64 unsigned transparent:1; |
7371
8b68d50090e4
Upstream: proxy_socket_keepalive and friends.
Vladimir Homutov <vl@nginx.com>
parents:
6735
diff
changeset
|
65 unsigned so_keepalive:1; |
7452
570d8c626eea
Modules compatibility: down flag in ngx_peer_connection_t.
Roman Arutyunyan <arut@nginx.com>
parents:
7371
diff
changeset
|
66 unsigned down:1; |
884 | 67 |
1284
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
68 /* ngx_connection_log_error_e */ |
be2b895d31e0
fix segfault when session was freed twice
Igor Sysoev <igor@sysoev.ru>
parents:
884
diff
changeset
|
69 unsigned log_error:2; |
6715
d200a0fd00b7
Introduced the NGX_COMPAT macro.
Ruslan Ermilov <ru@nginx.com>
parents:
6707
diff
changeset
|
70 |
d200a0fd00b7
Introduced the NGX_COMPAT macro.
Ruslan Ermilov <ru@nginx.com>
parents:
6707
diff
changeset
|
71 NGX_COMPAT_BEGIN(2) |
d200a0fd00b7
Introduced the NGX_COMPAT macro.
Ruslan Ermilov <ru@nginx.com>
parents:
6707
diff
changeset
|
72 NGX_COMPAT_END |
884 | 73 }; |
86
3973260705cc
nginx-0.0.1-2003-05-12-19:52:24 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
74 |
3973260705cc
nginx-0.0.1-2003-05-12-19:52:24 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
75 |
461 | 76 ngx_int_t ngx_event_connect_peer(ngx_peer_connection_t *pc); |
884 | 77 ngx_int_t ngx_event_get_peer(ngx_peer_connection_t *pc, void *data); |
78 | |
136
da00cde00e8a
nginx-0.0.1-2003-10-02-09:39:37 import
Igor Sysoev <igor@sysoev.ru>
parents:
124
diff
changeset
|
79 |
86
3973260705cc
nginx-0.0.1-2003-05-12-19:52:24 import
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
80 #endif /* _NGX_EVENT_CONNECT_H_INCLUDED_ */ |