mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-06-06 17:02:39 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixed buffer over-read while logging invalid request headers.

Browse Source 
Since 667aaf61a778 (1.1.17) the ngx_http_parse_header_line() function can return
NGX_HTTP_PARSE_INVALID_HEADER when a header contains NUL character.  In this
case the r->header_end pointer isn't properly initialized, but the log message
in ngx_http_process_request_headers() hasn't been adjusted.  It used the pointer
in size calculation, which might result in up to 2k buffer over-read.

Found with afl-fuzz.
This commit is contained in:
Valentin Bartenev 2016-02-24 16:01:23 +03:00
parent 4275d0a8a0
commit 1d294eea3e
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/http/ngx_http_request.c
View File

@ -1351,12 +1351,11 @@ ngx_http_process_request_headers(ngx_event_t *rev)
continue; continue;
} }
/* rc == NGX_HTTP_PARSE_INVALID_HEADER: "\r" is not followed by "\n" */ /* rc == NGX_HTTP_PARSE_INVALID_HEADER */
ngx_log_error(NGX_LOG_INFO, c->log, 0, ngx_log_error(NGX_LOG_INFO, c->log, 0,
"client sent invalid header line: \"%*s\\r...\"", "client sent invalid header line");
r->header_end - r->header_name_start,
r->header_name_start);
ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
return; return;
} }