From 69d94a9c6deae87f75e4bce4fe12b92a6a0e2a27 Mon Sep 17 00:00:00 2001 From: Maxim Dounin Date: Mon, 4 Jun 2012 11:07:19 +0000 Subject: [PATCH] Merge of r4618: rewrite escaping fix (ticket #162). The following code resulted in incorrect escaping of uri and possible segfault: location / { rewrite ^(.*) $1?c=$1; return 200 "$uri"; } If there were arguments in a rewrite's replacement string, and length was actually calculated (due to duplicate captures as in the example above, or variables present), the is_args flag was set and incorrectly copied after length calculation. This resulted in escaping applied to the uri part of the replacement, resulting in incorrect escaping. Additionally, buffer was allocated without escaping expected, thus this also resulted in buffer overrun and possible segfault. --- src/http/ngx_http_script.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c index ce290f4ef..e214519fc 100644 --- a/src/http/ngx_http_script.c +++ b/src/http/ngx_http_script.c @@ -1043,7 +1043,6 @@ ngx_http_script_regex_start_code(ngx_http_script_engine_t *e) } e->buf.len = len; - e->is_args = le.is_args; } if (code->add_args && r->args.len) {