Mercurial > hg > nginx

changeset 6533:b358d670c654

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Core: fixed port handling in ngx_parse_inet6_url(). This fixes buffer over-read when no port is specified in cases similar to 5df5d7d771f6, and catches missing port separator.
author Valentin Bartenev <vbart@nginx.com>
date Wed, 11 May 2016 17:55:20 +0300
parents 2f98b5709d79
children 19a54ba76c04
files src/core/ngx_inet.c
diffstat 1 files changed, 6 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/src/core/ngx_inet.c
+++ b/src/core/ngx_inet.c
@@ -861,7 +861,12 @@ ngx_parse_inet6_url(ngx_pool_t *pool, ng
             last = uri;
         }
 
-        if (*port == ':') {
+        if (port < last) {
+            if (*port != ':') {
+                u->err = "invalid host";
+                return NGX_ERROR;
+            }
+
             port++;
 
             len = last - port;