Mercurial > hg > nginx
changeset 4852:9be0b6b749ae stable-1.2
Merge of r4785, r4795, r4811, r4812, r4816, r4822: coverity.
*) Resolver: fixed possible memory leak in ngx_resolver_create().
*) Explicitly ignore returned value from unlink() in ngx_open_tempfile().
*) Explicitly ignore returned value from close() in ngx_event_core_init_conf().
*) Added three missing checks for NULL after ngx_array_push() calls.
*) Crypt: fixed handling of corrupted SSHA entries in password file.
*) Mark logically dead code with corresponding comment.
Found by / prodded by Coverity.
| author | Maxim Dounin <mdounin@mdounin.ru> |
|---|---|
| date | Mon, 24 Sep 2012 18:54:28 +0000 |
| parents | 6173853dd782 |
| children | 0b0ddfdbdd7b |
| files | src/core/ngx_crypt.c src/core/ngx_resolver.c src/event/ngx_event.c src/http/modules/ngx_http_fastcgi_module.c src/http/modules/ngx_http_limit_conn_module.c src/http/modules/ngx_http_limit_req_module.c src/http/modules/ngx_http_ssi_filter_module.c src/os/unix/ngx_files.c |
| diffstat | 8 files changed, 31 insertions(+), 13 deletions(-) [+] |
line wrap: on
line diff
--- a/src/core/ngx_crypt.c +++ b/src/core/ngx_crypt.c @@ -194,6 +194,7 @@ static ngx_int_t ngx_crypt_ssha(ngx_pool_t *pool, u_char *key, u_char *salt, u_char **encrypted) { size_t len; + ngx_int_t rc; ngx_str_t encoded, decoded; ngx_sha1_t sha1; @@ -204,12 +205,18 @@ ngx_crypt_ssha(ngx_pool_t *pool, u_char encoded.data = salt + sizeof("{SSHA}") - 1; encoded.len = ngx_strlen(encoded.data); - decoded.data = ngx_pnalloc(pool, ngx_base64_decoded_length(encoded.len)); + len = ngx_max(ngx_base64_decoded_length(encoded.len), 20); + + decoded.data = ngx_pnalloc(pool, len); if (decoded.data == NULL) { return NGX_ERROR; } - ngx_decode_base64(&decoded, &encoded); + rc = ngx_decode_base64(&decoded, &encoded); + + if (rc != NGX_OK || decoded.len < 20) { + decoded.len = 20; + } /* update SHA1 from key and salt */
--- a/src/core/ngx_resolver.c +++ b/src/core/ngx_resolver.c @@ -113,15 +113,6 @@ ngx_resolver_create(ngx_conf_t *cf, ngx_ return NULL; } - if (n) { - if (ngx_array_init(&r->udp_connections, cf->pool, n, - sizeof(ngx_udp_connection_t)) - != NGX_OK) - { - return NULL; - } - } - cln->data = r; r->event = ngx_calloc(sizeof(ngx_event_t), cf->log); @@ -153,6 +144,15 @@ ngx_resolver_create(ngx_conf_t *cf, ngx_ r->log = &cf->cycle->new_log; r->log_level = NGX_LOG_ERR; + if (n) { + if (ngx_array_init(&r->udp_connections, cf->pool, n, + sizeof(ngx_udp_connection_t)) + != NGX_OK) + { + return NULL; + } + } + for (i = 0; i < n; i++) { if (ngx_strncmp(names[i].data, "valid=", 6) == 0) { s.len = names[i].len - 6;
--- a/src/event/ngx_event.c +++ b/src/event/ngx_event.c @@ -1214,7 +1214,7 @@ ngx_event_core_init_conf(ngx_cycle_t *cy fd = epoll_create(100); if (fd != -1) { - close(fd); + (void) close(fd); module = &ngx_epoll_module; } else if (ngx_errno != NGX_ENOSYS) {
--- a/src/http/modules/ngx_http_fastcgi_module.c +++ b/src/http/modules/ngx_http_fastcgi_module.c @@ -1626,6 +1626,9 @@ ngx_http_fastcgi_process_header(ngx_http } part = ngx_array_push(f->split_parts); + if (part == NULL) { + return NGX_ERROR; + } part->start = part_start; part->end = part_end;
--- a/src/http/modules/ngx_http_limit_conn_module.c +++ b/src/http/modules/ngx_http_limit_conn_module.c @@ -721,6 +721,10 @@ ngx_http_limit_conn(ngx_conf_t *cf, ngx_ } limit = ngx_array_push(&lccf->limits); + if (limit == NULL) { + return NGX_CONF_ERROR; + } + limit->conn = n; limit->shm_zone = shm_zone;
--- a/src/http/modules/ngx_http_limit_req_module.c +++ b/src/http/modules/ngx_http_limit_req_module.c @@ -937,6 +937,9 @@ ngx_http_limit_req(ngx_conf_t *cf, ngx_c } limit = ngx_array_push(&lrcf->limits); + if (limit == NULL) { + return NGX_CONF_ERROR; + } limit->shm_zone = shm_zone; limit->burst = burst * 1000;