comparison src/http/ngx_http_core_module.c @ 6986:0cdee26605f3

Cleaned up r->headers_out.headers allocation error handling. If initialization of a header failed for some reason after ngx_list_push(), leaving the header as is can result in uninitialized memory access by the header filter or the log module. The fix is to clear partially initialized headers in case of errors. For the Cache-Control header, the fix is to postpone pushing r->headers_out.cache_control until its value is completed.
author Sergey Kandaurov <pluknet@nginx.com>
date Thu, 20 Apr 2017 18:26:37 +0300
parents be5cfa918bfc
children 9552758a786e
comparison
equal deleted inserted replaced
6985:23ecffd5bcfe 6986:0cdee26605f3
1000 } else { 1000 } else {
1001 len = clcf->name.len + 1 + r->args.len; 1001 len = clcf->name.len + 1 + r->args.len;
1002 p = ngx_pnalloc(r->pool, len); 1002 p = ngx_pnalloc(r->pool, len);
1003 1003
1004 if (p == NULL) { 1004 if (p == NULL) {
1005 ngx_http_clear_location(r);
1005 ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR); 1006 ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
1006 return NGX_OK; 1007 return NGX_OK;
1007 } 1008 }
1008 1009
1009 r->headers_out.location->value.len = len; 1010 r->headers_out.location->value.len = len;