Mercurial > hg > nginx

changeset 8088:e32b48848add

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SSL: improved validation of ssl_session_cache and ssl_ocsp_cache. Now it properly detects invalid shared zone configuration with omitted size. Previously it used to read outside of the buffer boundary. Found with AddressSanitizer.
author Sergey Kandaurov <pluknet@nginx.com>
date Mon, 17 Oct 2022 16:24:53 +0400
parents 81b4326daac7
children 4032c1bdfa14
files src/http/modules/ngx_http_ssl_module.c src/mail/ngx_mail_ssl_module.c src/stream/ngx_stream_ssl_module.c
diffstat 3 files changed, 4 insertions(+), 4 deletions(-) [+]
line wrap: on
line diff
--- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c
@@ -1093,7 +1093,7 @@ ngx_http_ssl_session_cache(ngx_conf_t *c
                 len++;
             }
 
-            if (len == 0) {
+            if (len == 0 || j == value[i].len) {
                 goto invalid;
             }
 
@@ -1183,7 +1183,7 @@ ngx_http_ssl_ocsp_cache(ngx_conf_t *cf, 
         len++;
     }
 
-    if (len == 0) {
+    if (len == 0 || j == value[1].len) {
         goto invalid;
     }
 
--- a/src/mail/ngx_mail_ssl_module.c
+++ b/src/mail/ngx_mail_ssl_module.c
@@ -682,7 +682,7 @@ ngx_mail_ssl_session_cache(ngx_conf_t *c
                 len++;
             }
 
-            if (len == 0) {
+            if (len == 0 || j == value[i].len) {
                 goto invalid;
             }
 
--- a/src/stream/ngx_stream_ssl_module.c
+++ b/src/stream/ngx_stream_ssl_module.c
@@ -1073,7 +1073,7 @@ ngx_stream_ssl_session_cache(ngx_conf_t 
                 len++;
             }
 
-            if (len == 0) {
+            if (len == 0 || j == value[i].len) {
                 goto invalid;
             }