mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-06-28 02:02:50 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Secure link: fixed stack buffer overflow.

Browse Source 
When secure link checksum has length of 23 or 24 bytes, decoded base64 value
could occupy 17 or 18 bytes which is more than 16 bytes previously allocated
for it on stack.  The buffer overflow does not have any security implications
since only one local variable was corrupted and this variable was not used in
this case.

The fix is to increase buffer size up to 18 bytes.  Useless buffer size
initialization is removed as well.
This commit is contained in:
Roman Arutyunyan 2017-08-22 21:22:59 +03:00
parent 6a2e409833
commit 418124e219
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/http/modules/ngx_http_secure_link_module.c
View File

@ -107,7 +107,7 @@ ngx_http_secure_link_variable(ngx_http_request_t *r,
ngx_md5_t md5;
ngx_http_secure_link_ctx_t *ctx;
ngx_http_secure_link_conf_t *conf;
u_char hash_buf[16], md5_buf[16];
u_char hash_buf[18], md5_buf[16];
conf = ngx_http_get_module_loc_conf(r, ngx_http_secure_link_module);
@ -154,7 +154,6 @@ ngx_http_secure_link_variable(ngx_http_request_t *r,
goto not_found;
}
hash.len = 16;
hash.data = hash_buf;
if (ngx_decode_base64url(&hash, &val) != NGX_OK) {