From c01481a4cb5c79e65bd259da6ad33a1eb95cc352 Mon Sep 17 00:00:00 2001 From: Maxim Dounin Date: Wed, 8 Oct 2014 17:16:04 +0400 Subject: [PATCH] Fixed possible buffer overrun in "too long header line" logging. Additionally, ellipsis now always added to make it clear that the header logged is incomplete. Reported by Daniil Bondarev. --- src/http/ngx_http_request.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index 2b932dee4..18c3b04e4 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -1227,12 +1227,11 @@ ngx_http_process_request_headers(ngx_event_t *rev) if (len > NGX_MAX_ERROR_STR - 300) { len = NGX_MAX_ERROR_STR - 300; - p[len++] = '.'; p[len++] = '.'; p[len++] = '.'; } ngx_log_error(NGX_LOG_INFO, c->log, 0, - "client sent too long header line: \"%*s\"", - len, r->header_name_start); + "client sent too long header line: \"%*s...\"", + len, r->header_name_start); ngx_http_finalize_request(r, NGX_HTTP_REQUEST_HEADER_TOO_LARGE);