Mercurial > hg > nginx
comparison src/http/ngx_http_variables.c @ 5815:6c99c5f00fc9
Variables: fixed non-indexed access of prefix vars (ticket #600).
Previously, a configuration like
location / {
ssi on;
ssi_types *;
set $http_foo "bar";
return 200 '<!--#echo var="http_foo" -->\n';
}
resulted in NULL pointer dereference in ngx_http_get_variable() as
the variable was explicitly added to the variables hash, but its
get_handler wasn't properly set in the hash. Fix is to make sure
that get_handler is properly set by ngx_http_variables_init_vars().
| author | Maxim Dounin <mdounin@mdounin.ru> |
|---|---|
| date | Wed, 27 Aug 2014 21:38:04 +0400 |
| parents | e9dbffc18a77 |
| children | a08fad30aeac |
comparison
equal
deleted
inserted
replaced
| 5814:a5886df87cbb | 5815:6c99c5f00fc9 |
|---|---|
| 2509 | 2509 |
| 2510 for (n = 0; n < cmcf->variables_keys->keys.nelts; n++) { | 2510 for (n = 0; n < cmcf->variables_keys->keys.nelts; n++) { |
| 2511 | 2511 |
| 2512 av = key[n].value; | 2512 av = key[n].value; |
| 2513 | 2513 |
| 2514 if (av->get_handler | 2514 if (v[i].name.len == key[n].key.len |
| 2515 && v[i].name.len == key[n].key.len | |
| 2516 && ngx_strncmp(v[i].name.data, key[n].key.data, v[i].name.len) | 2515 && ngx_strncmp(v[i].name.data, key[n].key.data, v[i].name.len) |
| 2517 == 0) | 2516 == 0) |
| 2518 { | 2517 { |
| 2519 v[i].get_handler = av->get_handler; | 2518 v[i].get_handler = av->get_handler; |
| 2520 v[i].data = av->data; | 2519 v[i].data = av->data; |
| 2521 | 2520 |
| 2522 av->flags |= NGX_HTTP_VAR_INDEXED; | 2521 av->flags |= NGX_HTTP_VAR_INDEXED; |
| 2523 v[i].flags = av->flags; | 2522 v[i].flags = av->flags; |
| 2524 | 2523 |
| 2525 av->index = i; | 2524 av->index = i; |
| 2525 | |
| 2526 if (av->get_handler == NULL) { | |
| 2527 break; | |
| 2528 } | |
| 2526 | 2529 |
| 2527 goto next; | 2530 goto next; |
| 2528 } | 2531 } |
| 2529 } | 2532 } |
| 2530 | 2533 |