Mercurial > hg > nginx
comparison src/http/modules/ngx_http_range_filter_module.c @ 6986:0cdee26605f3
Cleaned up r->headers_out.headers allocation error handling.
If initialization of a header failed for some reason after ngx_list_push(),
leaving the header as is can result in uninitialized memory access by
the header filter or the log module. The fix is to clear partially
initialized headers in case of errors.
For the Cache-Control header, the fix is to postpone pushing
r->headers_out.cache_control until its value is completed.
author | Sergey Kandaurov <pluknet@nginx.com> |
---|---|
date | Thu, 20 Apr 2017 18:26:37 +0300 |
parents | 2decd6b34306 |
children | aeaac3ccee4f |
comparison
equal
deleted
inserted
replaced
6985:23ecffd5bcfe | 6986:0cdee26605f3 |
---|---|
423 ngx_str_set(&content_range->key, "Content-Range"); | 423 ngx_str_set(&content_range->key, "Content-Range"); |
424 | 424 |
425 content_range->value.data = ngx_pnalloc(r->pool, | 425 content_range->value.data = ngx_pnalloc(r->pool, |
426 sizeof("bytes -/") - 1 + 3 * NGX_OFF_T_LEN); | 426 sizeof("bytes -/") - 1 + 3 * NGX_OFF_T_LEN); |
427 if (content_range->value.data == NULL) { | 427 if (content_range->value.data == NULL) { |
428 content_range->hash = 0; | |
429 r->headers_out.content_range = NULL; | |
428 return NGX_ERROR; | 430 return NGX_ERROR; |
429 } | 431 } |
430 | 432 |
431 /* "Content-Range: bytes SSSS-EEEE/TTTT" header */ | 433 /* "Content-Range: bytes SSSS-EEEE/TTTT" header */ |
432 | 434 |
592 ngx_str_set(&content_range->key, "Content-Range"); | 594 ngx_str_set(&content_range->key, "Content-Range"); |
593 | 595 |
594 content_range->value.data = ngx_pnalloc(r->pool, | 596 content_range->value.data = ngx_pnalloc(r->pool, |
595 sizeof("bytes */") - 1 + NGX_OFF_T_LEN); | 597 sizeof("bytes */") - 1 + NGX_OFF_T_LEN); |
596 if (content_range->value.data == NULL) { | 598 if (content_range->value.data == NULL) { |
599 content_range->hash = 0; | |
600 r->headers_out.content_range = NULL; | |
597 return NGX_ERROR; | 601 return NGX_ERROR; |
598 } | 602 } |
599 | 603 |
600 content_range->value.len = ngx_sprintf(content_range->value.data, | 604 content_range->value.len = ngx_sprintf(content_range->value.data, |
601 "bytes */%O", | 605 "bytes */%O", |