mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-06-12 21:52:41 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixed regex captures handling without PCRE.

Browse Source 
If PCRE is disabled, captures were treated as normal variables in
ngx_http_script_compile(), while code calculating flushes array length in
ngx_http_compile_complex_value() did not account captures as variables.
This could lead to write outside of the array boundary when setting
last element to -1.

Found with AddressSanitizer.
This commit is contained in:
Vladimir Homutov 2016-07-06 14:33:40 +03:00
parent 74305af672
commit 161fcf4bdd
2 changed files with 16 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/http/ngx_http_script.c
View File

@ -350,11 +350,9 @@ ngx_http_script_compile(ngx_http_script_compile_t *sc)
goto invalid_variable; goto invalid_variable;
} }
#if (NGX_PCRE)
{
ngx_uint_t n;
if (sc->source->data[i] >= '1' && sc->source->data[i] <= '9') { if (sc->source->data[i] >= '1' && sc->source->data[i] <= '9') {
#if (NGX_PCRE)
ngx_uint_t n;
n = sc->source->data[i] - '0'; n = sc->source->data[i] - '0';
@ -371,9 +369,13 @@ ngx_http_script_compile(ngx_http_script_compile_t *sc)
i++; i++;
continue; continue;
} #else
} ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0,
"using variable \"$%c\" requires "
"PCRE library", sc->source->data[i]);
return NGX_ERROR;
#endif #endif
}
if (sc->source->data[i] == '{') { if (sc->source->data[i] == '{') {
bracket = 1; bracket = 1;

14
src/stream/ngx_stream_script.c
View File

@ -282,11 +282,9 @@ ngx_stream_script_compile(ngx_stream_script_compile_t *sc)
goto invalid_variable; goto invalid_variable;
} }
#if (NGX_PCRE)
{
ngx_uint_t n;
if (sc->source->data[i] >= '1' && sc->source->data[i] <= '9') { if (sc->source->data[i] >= '1' && sc->source->data[i] <= '9') {
#if (NGX_PCRE)
ngx_uint_t n;
n = sc->source->data[i] - '0'; n = sc->source->data[i] - '0';
@ -297,9 +295,13 @@ ngx_stream_script_compile(ngx_stream_script_compile_t *sc)
i++; i++;
continue; continue;
} #else
} ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0,
"using variable \"$%c\" requires "
"PCRE library", sc->source->data[i]);
return NGX_ERROR;
#endif #endif
}
if (sc->source->data[i] == '{') { if (sc->source->data[i] == '{') {
bracket = 1; bracket = 1;