[nginx] svn commit: r4535 - in branches/stable-1.0: . src/http src/http/modules

mdounin at mdounin.ru mdounin at mdounin.ru
Thu Mar 15 11:41:43 UTC 2012


Author: mdounin
Date: 2012-03-15 11:41:43 +0000 (Thu, 15 Mar 2012)
New Revision: 4535

Log:
Merge of r4530, r4531: null character fixes.

*) Fixed incorrect ngx_cpystrn() usage in ngx_http_*_process_header().

   This resulted in a disclosure of previously freed memory if upstream
   server returned specially crafted response, potentially exposing
   sensitive information.

   Reported by Matthew Daley.

*) Headers with null character are now rejected.

   Headers with NUL character aren't allowed by HTTP standard and may cause
   various security problems.  They are now unconditionally rejected.


Modified:
   branches/stable-1.0/
   branches/stable-1.0/src/http/modules/ngx_http_fastcgi_module.c
   branches/stable-1.0/src/http/modules/ngx_http_proxy_module.c
   branches/stable-1.0/src/http/modules/ngx_http_scgi_module.c
   branches/stable-1.0/src/http/modules/ngx_http_uwsgi_module.c
   branches/stable-1.0/src/http/ngx_http_parse.c


Property changes on: branches/stable-1.0
___________________________________________________________________
Modified: svn:mergeinfo
   - /trunk:3960-3974,3977-3987,3991-3996,3998,4000-4018,4020,4023,4025-4027,4034-4065,4073,4077,4086-4090,4094-4102,4106-4108,4113-4114,4129-4137,4143-4144,4147-4158,4177,4179,4182-4184,4186-4187,4189-4205,4207,4209-4210,4212,4217-4223,4227-4232,4235-4237,4265-4268,4270,4274-4276,4278-4280,4282-4284,4294-4295,4298,4300-4309,4313,4315,4320-4321,4326-4327,4335-4336,4338-4343,4372-4375,4377,4379,4381-4385,4393,4396,4398,4400-4406,4413,4415-4416,4422-4423,4460-4461,4468,4470-4471,4473-4474,4491-4493,4497-4500
   + /trunk:3960-3974,3977-3987,3991-3996,3998,4000-4018,4020,4023,4025-4027,4034-4065,4073,4077,4086-4090,4094-4102,4106-4108,4113-4114,4129-4137,4143-4144,4147-4158,4177,4179,4182-4184,4186-4187,4189-4205,4207,4209-4210,4212,4217-4223,4227-4232,4235-4237,4265-4268,4270,4274-4276,4278-4280,4282-4284,4294-4295,4298,4300-4309,4313,4315,4320-4321,4326-4327,4335-4336,4338-4343,4372-4375,4377,4379,4381-4385,4393,4396,4398,4400-4406,4413,4415-4416,4422-4423,4460-4461,4468,4470-4471,4473-4474,4491-4493,4497-4500,4530-4531

Modified: branches/stable-1.0/src/http/modules/ngx_http_fastcgi_module.c
===================================================================
--- branches/stable-1.0/src/http/modules/ngx_http_fastcgi_module.c	2012-03-15 11:37:11 UTC (rev 4534)
+++ branches/stable-1.0/src/http/modules/ngx_http_fastcgi_module.c	2012-03-15 11:41:43 UTC (rev 4535)
@@ -1446,10 +1446,10 @@
                     h->lowcase_key = h->key.data + h->key.len + 1
                                      + h->value.len + 1;
 
-                    ngx_cpystrn(h->key.data, r->header_name_start,
-                                h->key.len + 1);
-                    ngx_cpystrn(h->value.data, r->header_start,
-                                h->value.len + 1);
+                    ngx_memcpy(h->key.data, r->header_name_start, h->key.len);
+                    h->key.data[h->key.len] = '\0';
+                    ngx_memcpy(h->value.data, r->header_start, h->value.len);
+                    h->value.data[h->value.len] = '\0';
                 }
 
                 h->hash = r->header_hash;

Modified: branches/stable-1.0/src/http/modules/ngx_http_proxy_module.c
===================================================================
--- branches/stable-1.0/src/http/modules/ngx_http_proxy_module.c	2012-03-15 11:37:11 UTC (rev 4534)
+++ branches/stable-1.0/src/http/modules/ngx_http_proxy_module.c	2012-03-15 11:41:43 UTC (rev 4535)
@@ -1278,8 +1278,10 @@
             h->value.data = h->key.data + h->key.len + 1;
             h->lowcase_key = h->key.data + h->key.len + 1 + h->value.len + 1;
 
-            ngx_cpystrn(h->key.data, r->header_name_start, h->key.len + 1);
-            ngx_cpystrn(h->value.data, r->header_start, h->value.len + 1);
+            ngx_memcpy(h->key.data, r->header_name_start, h->key.len);
+            h->key.data[h->key.len] = '\0';
+            ngx_memcpy(h->value.data, r->header_start, h->value.len);
+            h->value.data[h->value.len] = '\0';
 
             if (h->key.len == r->lowcase_index) {
                 ngx_memcpy(h->lowcase_key, r->lowcase_header, h->key.len);

Modified: branches/stable-1.0/src/http/modules/ngx_http_scgi_module.c
===================================================================
--- branches/stable-1.0/src/http/modules/ngx_http_scgi_module.c	2012-03-15 11:37:11 UTC (rev 4534)
+++ branches/stable-1.0/src/http/modules/ngx_http_scgi_module.c	2012-03-15 11:41:43 UTC (rev 4535)
@@ -894,8 +894,10 @@
             h->value.data = h->key.data + h->key.len + 1;
             h->lowcase_key = h->key.data + h->key.len + 1 + h->value.len + 1;
 
-            ngx_cpystrn(h->key.data, r->header_name_start, h->key.len + 1);
-            ngx_cpystrn(h->value.data, r->header_start, h->value.len + 1);
+            ngx_memcpy(h->key.data, r->header_name_start, h->key.len);
+            h->key.data[h->key.len] = '\0';
+            ngx_memcpy(h->value.data, r->header_start, h->value.len);
+            h->value.data[h->value.len] = '\0';
 
             if (h->key.len == r->lowcase_index) {
                 ngx_memcpy(h->lowcase_key, r->lowcase_header, h->key.len);

Modified: branches/stable-1.0/src/http/modules/ngx_http_uwsgi_module.c
===================================================================
--- branches/stable-1.0/src/http/modules/ngx_http_uwsgi_module.c	2012-03-15 11:37:11 UTC (rev 4534)
+++ branches/stable-1.0/src/http/modules/ngx_http_uwsgi_module.c	2012-03-15 11:41:43 UTC (rev 4535)
@@ -947,8 +947,10 @@
             h->value.data = h->key.data + h->key.len + 1;
             h->lowcase_key = h->key.data + h->key.len + 1 + h->value.len + 1;
 
-            ngx_cpystrn(h->key.data, r->header_name_start, h->key.len + 1);
-            ngx_cpystrn(h->value.data, r->header_start, h->value.len + 1);
+            ngx_memcpy(h->key.data, r->header_name_start, h->key.len);
+            h->key.data[h->key.len] = '\0';
+            ngx_memcpy(h->value.data, r->header_start, h->value.len);
+            h->value.data[h->value.len] = '\0';
 
             if (h->key.len == r->lowcase_index) {
                 ngx_memcpy(h->lowcase_key, r->lowcase_header, h->key.len);

Modified: branches/stable-1.0/src/http/ngx_http_parse.c
===================================================================
--- branches/stable-1.0/src/http/ngx_http_parse.c	2012-03-15 11:37:11 UTC (rev 4534)
+++ branches/stable-1.0/src/http/ngx_http_parse.c	2012-03-15 11:41:43 UTC (rev 4535)
@@ -814,6 +814,10 @@
                     break;
                 }
 
+                if (ch == '\0') {
+                    return NGX_HTTP_PARSE_INVALID_HEADER;
+                }
+
                 r->invalid_header = 1;
 
                 break;
@@ -876,6 +880,10 @@
                 break;
             }
 
+            if (ch == '\0') {
+                return NGX_HTTP_PARSE_INVALID_HEADER;
+            }
+
             r->invalid_header = 1;
 
             break;
@@ -894,6 +902,8 @@
                 r->header_start = p;
                 r->header_end = p;
                 goto done;
+            case '\0':
+                return NGX_HTTP_PARSE_INVALID_HEADER;
             default:
                 r->header_start = p;
                 state = sw_value;
@@ -915,6 +925,8 @@
             case LF:
                 r->header_end = p;
                 goto done;
+            case '\0':
+                return NGX_HTTP_PARSE_INVALID_HEADER;
             }
             break;
 
@@ -928,6 +940,8 @@
                 break;
             case LF:
                 goto done;
+            case '\0':
+                return NGX_HTTP_PARSE_INVALID_HEADER;
             default:
                 state = sw_value;
                 break;



More information about the nginx-devel mailing list