comparison src/http/modules/ngx_http_ssi_filter_module.c @ 7539:d75153522557

SSI: avoid potential buffer overflow. When "-" follows a parameter of maximum length, a single byte buffer overflow happens, since the error branch does not check parameter length. Fix is to avoid saving "-" to the parameter key, and instead use an error message with "-" explicitly written. The message is mostly identical to one used in similar cases in the preequal state. Reported by Patrick Wollgast.
author Maxim Dounin <mdounin@mdounin.ru>
date Thu, 18 Jul 2019 18:27:53 +0300
parents 20f139e9ffa8
children 49e7db44b57c
comparison
equal deleted inserted replaced
7538:08ed570ad93c 7539:d75153522557
1252 break; 1252 break;
1253 1253
1254 case '-': 1254 case '-':
1255 state = ssi_error_end0_state; 1255 state = ssi_error_end0_state;
1256 1256
1257 ctx->param->key.data[ctx->param->key.len++] = ch;
1258 ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, 1257 ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
1259 "invalid \"%V\" parameter in \"%V\" SSI command", 1258 "unexpected \"-\" symbol after \"%V\" "
1259 "parameter in \"%V\" SSI command",
1260 &ctx->param->key, &ctx->command); 1260 &ctx->param->key, &ctx->command);
1261 break; 1261 break;
1262 1262
1263 default: 1263 default:
1264 if (ctx->param->key.len == NGX_HTTP_SSI_PARAM_LEN) { 1264 if (ctx->param->key.len == NGX_HTTP_SSI_PARAM_LEN) {