Thanks!<br><br>I <span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: 'Times New Roman'; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="font-family: arial; line-height: 18px; font-size: small; ">refactor </span></span>the prev patch.<br>
<br>this is new patch:<br><br>Index: src/http/modules/ngx_http_fastcgi_module.c<br>===================================================================<br>--- src/http/modules/ngx_http_fastcgi_module.c (revision 3937)<br>
+++ src/http/modules/ngx_http_fastcgi_module.c (working copy)<br>@@ -165,6 +165,8 @@<br> static char *ngx_http_fastcgi_lowat_check(ngx_conf_t *cf, void *post,<br> void *data);<br> <br>+static ngx_int_t ngx_http_fastcgi_ignored_header(ngx_table_elt_t **ignored,<br>
+ ngx_table_elt_t *header, ngx_uint_t params, ngx_uint_t allow_underscores);<br> <br> static ngx_conf_post_t ngx_http_fastcgi_lowat_post =<br> { ngx_http_fastcgi_lowat_check };<br>@@ -685,13 +687,72 @@<br> <br> <br>
static ngx_int_t<br>+ngx_http_fastcgi_ignored_header(ngx_table_elt_t **ignored,<br>+ ngx_table_elt_t *header, ngx_uint_t params, ngx_uint_t allow_underscores)<br>+{<br>+ u_char k1, k2;<br>+ ngx_uint_t n, i, duplicate;<br>
+ ngx_table_elt_t *h;<br>+<br>+ for (n = 0; n < params; n++) {<br>+ h = ignored[n];<br>+<br>+ if (h == header) {<br>+ return NGX_OK;<br>+ }<br>+<br>+ if (header->key.len != h->key.len) {<br>
+ continue;<br>+ }<br>+<br>+ if (allow_underscores) {<br>+ duplicate = 1;<br>+<br>+ for (i = 0; i < header->key.len; i++) {<br>+<br>+ k1 = header->lowcase_key[i];<br>
+ k2 = h->lowcase_key[i];<br>+<br>+ if (k1 == k2) {<br>+ continue;<br>+ }<br>+<br>+ if ((k1 == '_' && k2 == '-') || (k1 == '-' && k2 == '_')) {<br>
+ continue;<br>+ }<br>+<br>+ duplicate = 0;<br>+ break;<br>+ }<br>+<br>+ if (duplicate) {<br>+ return NGX_OK;<br>+ }<br>
+<br>+ } else {<br>+<br>+ if (ngx_memcmp(header->lowcase_key, h->lowcase_key,<br>+ header->key.len) == 0)<br>+ {<br>+ return NGX_OK;<br>+ }<br>
+ }<br>+<br>+ }<br>+<br>+ return NGX_DECLINED;<br>+}<br>+<br>+<br>+static ngx_int_t<br> ngx_http_fastcgi_create_request(ngx_http_request_t *r)<br> {<br> off_t file_pos;<br> u_char ch, *pos, *lowcase_key;<br>
size_t size, len, key_len, val_len, padding,<br> allocated;<br>- ngx_uint_t i, n, next, hash, header_params;<br>+ ngx_uint_t i, n, next, hash, header_params,<br>
+ allow_underscores;<br> ngx_buf_t *b;<br> ngx_chain_t *cl, *body;<br> ngx_list_part_t *part;<br>@@ -699,6 +760,7 @@<br> ngx_http_script_code_pt code;<br>
ngx_http_script_engine_t e, le;<br> ngx_http_fastcgi_header_t *h;<br>+ ngx_http_core_srv_conf_t *cscf;<br> ngx_http_fastcgi_loc_conf_t *flcf;<br> ngx_http_script_len_code_pt lcode;<br> <br>
@@ -707,7 +769,10 @@<br> ignored = NULL;<br> <br> flcf = ngx_http_get_module_loc_conf(r, ngx_http_fastcgi_module);<br>+ cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);<br> <br>+ allow_underscores = cscf->underscores_in_headers;<br>
+<br> if (flcf->params_len) {<br> ngx_memzero(&le, sizeof(ngx_http_script_engine_t));<br> <br>@@ -784,6 +849,14 @@<br> }<br> <br> if (ngx_hash_find(&flcf->headers_hash, hash, lowcase_key, n)) {<br>
+<br>+ if (header_params == flcf->header_params<br>+ || ngx_http_fastcgi_ignored_header(ignored, &header[i],<br>+ header_params, allow_underscores) == NGX_OK)<br>
+ {<br>+ continue;<br>+ }<br>+<br> ignored[header_params++] = &header[i];<br> continue;<br> }<br>@@ -915,10 +988,10 @@<br>
i = 0;<br> }<br> <br>- for (n = 0; n < header_params; n++) {<br>- if (&header[i] == ignored[n]) {<br>- goto next;<br>- }<br>
+ if (ngx_http_fastcgi_ignored_header(ignored, &header[i],<br>
+ header_params, allow_underscores) == NGX_OK)<br>+ {<br>+ continue;<br> }<br> <br> key_len = sizeof("HTTP_") - 1 + header[i].key.len;<br>@@ -964,9 +1037,6 @@<br>
"fastcgi param: \"%*s: %*s\"",<br> key_len, b->last - (key_len + val_len),<br> val_len, b->last - val_len);<br>- next:<br>
-<br>- continue;<br> }<br> }<br><br><br><div class="gmail_quote">On Fri, Jun 10, 2011 at 2:53 PM, Simon Liu <span dir="ltr"><<a href="mailto:simohayha.bobo@gmail.com">simohayha.bobo@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Thanks!<div class="im"><br><br>This is new patch:<br><br>Index: src/http/modules/ngx_http_fastcgi_module.c<br>===================================================================<br>
--- src/http/modules/ngx_http_fastcgi_module.c (revision 3937)<br>
+++ src/http/modules/ngx_http_fastcgi_module.c (working copy)<br>@@ -165,7 +165,10 @@<br> static char *ngx_http_fastcgi_lowat_check(ngx_conf_t *cf, void *post,<br> void *data);<br> <br></div>+static ngx_int_t ngx_http_fastcgi_ignored_header(ngx_table_elt_t **ignored,<br>
+ ngx_table_elt_t *header, ngx_uint_t header_params, ngx_uint_t allow_underscores)<div class="im"><br> <br>+<br> static ngx_conf_post_t ngx_http_fastcgi_lowat_post =<br> { ngx_http_fastcgi_lowat_check };<br> <br>
</div>@@ -685,6 +688,57 @@<br>
<br> <br> static ngx_int_t<div class="im"><br>+ngx_http_fastcgi_ignored_header(ngx_table_elt_t **ignored, ngx_table_elt_t *header,<br></div>+ ngx_uint_t header_params, ngx_uint_t allow_underscores)<br>+{<br>+ ngx_uint_t n, i, duplicate;<br>
+ ngx_table_elt_t *h;<div class="im"><br>+<br>+ for (n = 0; n < header_params; n++) {<br>+ h = ignored[n];<br>+<br></div>+ if (h == header) {<br>+ return NGX_OK;<br>+ }<br>+<br>
+ if (header->key.len != h->key.len) {<br>
+ continue;<br>+ }<br>+<br>+ if (allow_underscores) {<br>+ duplicate = 1;<br>+<br>+ for (i = 0; i < header->key.len; i++) {<br>+<br>+ if (header->lowcase_key[i] != h->lowcase_key[i]) {<br>
+ if ((header->lowcase_key[i] == '_' && h->lowcase_key[i] == '-')<br>+ || (header->lowcase_key[i] == '-' && h->lowcase_key[i] == '_')) {<br>
+ continue;<br>+ }<br>+<br>+ duplicate = 0;<br>+ break;<br>+ }<br>+ }<br>+<br>+ if (duplicate) {<br>+ return NGX_OK;<br>
+ }<br>+<br>+ } else {<br>+<br>+ if (ngx_memcmp(header->lowcase_key, h->lowcase_key, header->key.len) == 0) {<br>+<br>+ return NGX_OK;<br>+ }<br>+ }<br>
+ }<br>+<br>+ return NGX_DECLINED;<br>+}<br>+<br>+<br>+static ngx_int_t<div class="im"><br> ngx_http_fastcgi_create_request(ngx_http_request_t *r)<br> {<br></div> off_t file_pos;<br>@@ -699,6 +753,7 @@<div class="im">
<br> ngx_http_script_code_pt code;<br>
ngx_http_script_engine_t e, le;<br> ngx_http_fastcgi_header_t *h;<br></div>+ ngx_http_core_srv_conf_t *cscf;<br> ngx_http_fastcgi_loc_conf_t *flcf;<br> ngx_http_script_len_code_pt lcode;<br>
<br>
@@ -707,6 +762,7 @@<br> ignored = NULL;<br> <br> flcf = ngx_http_get_module_loc_conf(r, ngx_http_fastcgi_module);<br>+ cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);<br> <br> if (flcf->params_len) {<br>
ngx_memzero(&le, sizeof(ngx_http_script_engine_t));<br>@@ -784,6 +840,13 @@<div class="im"><br> }<br> <br> if (ngx_hash_find(&flcf->headers_hash, hash, lowcase_key, n)) {<br>
+<br></div>+ if (header_params == flcf->header_params ||<br>
+ ngx_http_fastcgi_ignored_header(ignored, &header[i],<br>+ header_params, cscf->underscores_in_headers) == NGX_OK) {<div class="im"><br>+ continue;<br>
+ }<br>
+<br> ignored[header_params++] = &header[i];<br> continue;<br> }<br></div>@@ -915,10 +978,9 @@<div class="im"><br> i = 0;<br> }<br> <br>
- for (n = 0; n < header_params; n++) {<br>
- if (&header[i] == ignored[n]) {<br>- goto next;<br>- }<br></div><div class="im">+ if (ngx_http_fastcgi_ignored_header(ignored, &header[i],<br></div>+ header_params, cscf->underscores_in_headers) == NGX_OK) {<div class="im">
<br>
+ continue;<br> }<br> <br> key_len = sizeof("HTTP_") - 1 + header[i].key.len;<br></div>@@ -964,9 +1026,6 @@<div class="im"><br> "fastcgi param: \"%*s: %*s\"",<br>
key_len, b->last - (key_len + val_len),<br> val_len, b->last - val_len);<br>- next:<br>-<br>- continue;<br> }<br> }<br><br><br><br>
</div><div><div></div><div class="h5"><div class="gmail_quote">On Thu, Jun 2, 2011 at 5:52 PM, Maxim Dounin <span dir="ltr"><<a href="mailto:mdounin@mdounin.ru" target="_blank">mdounin@mdounin.ru</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello!<br>
<div><br>
On Thu, Jun 02, 2011 at 03:28:50PM +0800, Simon Liu wrote:<br>
<br>
> Thanks for your review.<br>
><br>
> this is new patch:<br>
<br>
</div>[...]<br>
<div><br>
> +static ngx_inline ngx_int_t<br>
> +ngx_http_fastcgi_ignored_header(ngx_table_elt_t **ignored, ngx_table_elt_t<br>
> *header, ngx_uint_t header_params)<br>
> +{<br>
> + ngx_uint_t n;<br>
> + ngx_table_elt_t *h;<br>
> +<br>
> + for (n = 0; n < header_params; n++) {<br>
> + h = ignored[n];<br>
> +<br>
> + if (header->key.len == h->key.len<br>
> + && ngx_memcmp(header->lowcase_key, h->lowcase_key,<br>
> header->key.len) == 0) {<br>
> +<br>
> + return NGX_OK;<br>
<br>
</div>This relies on lowcase_key of the first added header and the<br>
duplicate one to match, but it's may not be true, e.g.<br>
<br>
X-Blah-Blah<br>
X_Blah_Blah<br>
<br>
would have non-matching lowcase_key (but both should be ignored,<br>
as they both maps to HTTP_BLAH_BLAH fastcgi key). Request with<br>
such duplicate headers will cause the same buffer overflow as in<br>
the original bug (again, assuming underscores_in_headers is on).<br>
<div><div></div><div><br>
Maxim Dounin<br>
<br>
_______________________________________________<br>
nginx-devel mailing list<br>
<a href="mailto:nginx-devel@nginx.org" target="_blank">nginx-devel@nginx.org</a><br>
<a href="http://nginx.org/mailman/listinfo/nginx-devel" target="_blank">http://nginx.org/mailman/listinfo/nginx-devel</a><br>
</div></div></blockquote></div><br><br clear="all"><br></div></div><div><div></div><div class="h5">-- <br>博观约取<br><br>豆瓣:<a href="http://www.douban.com/people/mustang/" target="_blank">www.douban.com/people/mustang/</a><br>
<br>blog: <a href="http://www.pagefault.info" target="_blank">www.pagefault.info</a><br>
<br>twitter: <a href="http://www.twitter.com/minibobo" target="_blank">www.twitter.com/minibobo</a><br><br>sina 微博: <a href="http://www.weibo.com/diaoliang" target="_blank">www.weibo.com/diaoliang</a><br><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>博观约取<br><br>豆瓣:<a href="http://www.douban.com/people/mustang/" target="_blank">www.douban.com/people/mustang/</a><br><br>blog: <a href="http://www.pagefault.info" target="_blank">www.pagefault.info</a><br>
<br>twitter: <a href="http://www.twitter.com/minibobo" target="_blank">www.twitter.com/minibobo</a><br><br>sina 微博: <a href="http://www.weibo.com/diaoliang" target="_blank">www.weibo.com/diaoliang</a><br><br>