comparison src/core/ngx_string.c @ 7494:a42a6dfeb01a

Fixed incorrect length handling in ngx_utf8_length(). Previously, ngx_utf8_decode() was called from ngx_utf8_length() with incorrect length, potentially resulting in out-of-bounds read when handling invalid UTF-8 strings. In practice out-of-bounds reads are not possible though, as autoindex, the only user of ngx_utf8_length(), provides null-terminated strings, and ngx_utf8_decode() anyway returns an errors when it sees a null in the middle of an UTF-8 sequence. Reported by Yunbin Liu.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 15 Apr 2019 20:14:07 +0300
parents 9ca82f273967
children a46fcf101cfc
comparison
equal deleted inserted replaced
7493:dbebbb25ae92 7494:a42a6dfeb01a
1379 if (c < 0x80) { 1379 if (c < 0x80) {
1380 p++; 1380 p++;
1381 continue; 1381 continue;
1382 } 1382 }
1383 1383
1384 if (ngx_utf8_decode(&p, n) > 0x10ffff) { 1384 if (ngx_utf8_decode(&p, last - p) > 0x10ffff) {
1385 /* invalid UTF-8 */ 1385 /* invalid UTF-8 */
1386 return n; 1386 return n;
1387 } 1387 }
1388 } 1388 }
1389 1389