Mercurial > hg > nginx
comparison src/http/modules/ngx_http_dav_module.c @ 5781:1f70fe0d9576
Dav: ngx_http_map_uri_to_path() errors were not checked.
Once error occured, it could lead to use uninitialized variables to log,
even more segmentation fault.
author | FengGu <flygoast@126.com> |
---|---|
date | Wed, 30 Jul 2014 14:45:08 +0800 |
parents | 5c52ff68f380 |
children | 8b6fa4842133 |
comparison
equal
deleted
inserted
replaced
5780:f1e05e533c8b | 5781:1f70fe0d9576 |
---|---|
210 if (r->request_body == NULL || r->request_body->temp_file == NULL) { | 210 if (r->request_body == NULL || r->request_body->temp_file == NULL) { |
211 ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR); | 211 ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR); |
212 return; | 212 return; |
213 } | 213 } |
214 | 214 |
215 ngx_http_map_uri_to_path(r, &path, &root, 0); | 215 if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) { |
216 ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR); | |
217 return; | |
218 } | |
216 | 219 |
217 path.len--; | 220 path.len--; |
218 | 221 |
219 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, | 222 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, |
220 "http put filename: \"%s\"", path.data); | 223 "http put filename: \"%s\"", path.data); |
318 return NGX_HTTP_CONFLICT; | 321 return NGX_HTTP_CONFLICT; |
319 } | 322 } |
320 | 323 |
321 ok: | 324 ok: |
322 | 325 |
323 ngx_http_map_uri_to_path(r, &path, &root, 0); | 326 if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) { |
327 return NGX_HTTP_INTERNAL_SERVER_ERROR; | |
328 } | |
324 | 329 |
325 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, | 330 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, |
326 "http delete filename: \"%s\"", path.data); | 331 "http delete filename: \"%s\"", path.data); |
327 | 332 |
328 if (ngx_link_info(path.data, &fi) == NGX_FILE_ERROR) { | 333 if (ngx_link_info(path.data, &fi) == NGX_FILE_ERROR) { |
486 "MKCOL can create a collection only"); | 491 "MKCOL can create a collection only"); |
487 return NGX_HTTP_CONFLICT; | 492 return NGX_HTTP_CONFLICT; |
488 } | 493 } |
489 | 494 |
490 p = ngx_http_map_uri_to_path(r, &path, &root, 0); | 495 p = ngx_http_map_uri_to_path(r, &path, &root, 0); |
496 if (p == NULL) { | |
497 return NGX_HTTP_INTERNAL_SERVER_ERROR; | |
498 } | |
491 | 499 |
492 *(p - 1) = '\0'; | 500 *(p - 1) = '\0'; |
493 r->uri.len--; | 501 r->uri.len--; |
494 | 502 |
495 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, | 503 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, |
664 | 672 |
665 overwrite = 1; | 673 overwrite = 1; |
666 | 674 |
667 overwrite_done: | 675 overwrite_done: |
668 | 676 |
669 ngx_http_map_uri_to_path(r, &path, &root, 0); | 677 if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) { |
678 return NGX_HTTP_INTERNAL_SERVER_ERROR; | |
679 } | |
670 | 680 |
671 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, | 681 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, |
672 "http copy from: \"%s\"", path.data); | 682 "http copy from: \"%s\"", path.data); |
673 | 683 |
674 uri = r->uri; | 684 uri = r->uri; |
675 r->uri = duri; | 685 r->uri = duri; |
676 | 686 |
677 ngx_http_map_uri_to_path(r, ©.path, &root, 0); | 687 if (ngx_http_map_uri_to_path(r, ©.path, &root, 0) == NULL) { |
688 return NGX_HTTP_INTERNAL_SERVER_ERROR; | |
689 } | |
678 | 690 |
679 r->uri = uri; | 691 r->uri = uri; |
680 | 692 |
681 copy.path.len--; /* omit "\0" */ | 693 copy.path.len--; /* omit "\0" */ |
682 | 694 |