Mercurial > hg > nginx
view src/core/ngx_slab.h @ 7494:a42a6dfeb01a
Fixed incorrect length handling in ngx_utf8_length().
Previously, ngx_utf8_decode() was called from ngx_utf8_length() with
incorrect length, potentially resulting in out-of-bounds read when
handling invalid UTF-8 strings.
In practice out-of-bounds reads are not possible though, as autoindex, the
only user of ngx_utf8_length(), provides null-terminated strings, and
ngx_utf8_decode() anyway returns an errors when it sees a null in the
middle of an UTF-8 sequence.
Reported by Yunbin Liu.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Mon, 15 Apr 2019 20:14:07 +0300 |
parents | 69f9ee0342db |
children |
line wrap: on
line source
/* * Copyright (C) Igor Sysoev * Copyright (C) Nginx, Inc. */ #ifndef _NGX_SLAB_H_INCLUDED_ #define _NGX_SLAB_H_INCLUDED_ #include <ngx_config.h> #include <ngx_core.h> typedef struct ngx_slab_page_s ngx_slab_page_t; struct ngx_slab_page_s { uintptr_t slab; ngx_slab_page_t *next; uintptr_t prev; }; typedef struct { ngx_uint_t total; ngx_uint_t used; ngx_uint_t reqs; ngx_uint_t fails; } ngx_slab_stat_t; typedef struct { ngx_shmtx_sh_t lock; size_t min_size; size_t min_shift; ngx_slab_page_t *pages; ngx_slab_page_t *last; ngx_slab_page_t free; ngx_slab_stat_t *stats; ngx_uint_t pfree; u_char *start; u_char *end; ngx_shmtx_t mutex; u_char *log_ctx; u_char zero; unsigned log_nomem:1; void *data; void *addr; } ngx_slab_pool_t; void ngx_slab_sizes_init(void); void ngx_slab_init(ngx_slab_pool_t *pool); void *ngx_slab_alloc(ngx_slab_pool_t *pool, size_t size); void *ngx_slab_alloc_locked(ngx_slab_pool_t *pool, size_t size); void *ngx_slab_calloc(ngx_slab_pool_t *pool, size_t size); void *ngx_slab_calloc_locked(ngx_slab_pool_t *pool, size_t size); void ngx_slab_free(ngx_slab_pool_t *pool, void *p); void ngx_slab_free_locked(ngx_slab_pool_t *pool, void *p); #endif /* _NGX_SLAB_H_INCLUDED_ */