mirror of
https://github.com/nginx/nginx.git
synced 2024-12-16 22:47:47 +08:00
7930a6c442
A configuration with a named location inside a zero-length prefix
or regex location used to trigger a segmentation fault, as
ngx_http_core_location() failed to properly detect if a nested location
was created. Example configuration to reproduce the problem:
location "" {
location @foo {}
}
Fix is to not rely on a parent location name length, but rather check
command type we are currently parsing.
Identical fix is also applied to ngx_http_rewrite_if(), which used to
incorrectly assume the "if" directive is on server{} level in such
locations.
Reported by Markus Linnala.
Found with afl-fuzz.
|
||
|---|---|---|
| .. | ||
| modules | ||
| ngx_http_cache.h | ||
| ngx_http_config.h | ||
| ngx_http_copy_filter_module.c | ||
| ngx_http_core_module.c | ||
| ngx_http_core_module.h | ||
| ngx_http_file_cache.c | ||
| ngx_http_header_filter_module.c | ||
| ngx_http_parse.c | ||
| ngx_http_postpone_filter_module.c | ||
| ngx_http_request_body.c | ||
| ngx_http_request.c | ||
| ngx_http_request.h | ||
| ngx_http_script.c | ||
| ngx_http_script.h | ||
| ngx_http_spdy_filter_module.c | ||
| ngx_http_spdy_module.c | ||
| ngx_http_spdy_module.h | ||
| ngx_http_spdy.c | ||
| ngx_http_spdy.h | ||
| ngx_http_special_response.c | ||
| ngx_http_upstream_round_robin.c | ||
| ngx_http_upstream_round_robin.h | ||
| ngx_http_upstream.c | ||
| ngx_http_upstream.h | ||
| ngx_http_variables.c | ||
| ngx_http_variables.h | ||
| ngx_http_write_filter_module.c | ||
| ngx_http.c | ||
| ngx_http.h | ||