<div style="line-height:1.7;color:#000000;font-size:14px;font-family:arial"><div># HG changeset patch</div><div># User FengGu <flygoast@126.com></div><div># Date 1406702708 -28800</div><div>#      Wed Jul 30 14:45:08 2014 +0800</div><div># Node ID 9a9f7c2783b1afe0e5d374450daa5df6acbfd332</div><div># Parent  4d092aa2f4637ce50284d2accd99a8e91aae2b4c</div><div>Dav: ngx_http_map_uri_to_path() errors were not checked.</div><div><br></div><div>Once error occured, it could lead to use uninitialized variables to log,</div><div>even more segmentation fault.</div><div><br></div><div>diff -r 4d092aa2f463 -r 9a9f7c2783b1 src/http/modules/ngx_http_dav_module.c</div><div>--- a/src/http/modules/ngx_http_dav_module.c<span class="Apple-tab-span" style="white-space:pre">       </span>Mon Jul 28 12:27:57 2014 -0700</div><div>+++ b/src/http/modules/ngx_http_dav_module.c<span class="Apple-tab-span" style="white-space:pre">   </span>Wed Jul 30 14:45:08 2014 +0800</div><div>@@ -212,7 +212,10 @@</div><div>         return;</div><div>     }</div><div> </div><div>-    ngx_http_map_uri_to_path(r, &path, &root, 0);</div><div>+    if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {</div><div>+        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);</div><div>+        return;</div><div>+    }</div><div> </div><div>     path.len--;</div><div> </div><div>@@ -320,7 +323,9 @@</div><div> </div><div> ok:</div><div> </div><div>-    ngx_http_map_uri_to_path(r, &path, &root, 0);</div><div>+    if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {</div><div>+        return NGX_HTTP_INTERNAL_SERVER_ERROR;</div><div>+    }</div><div> </div><div>     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,</div><div>                    "http delete filename: \"%s\"", path.data);</div><div>@@ -488,6 +493,9 @@</div><div>     }</div><div> </div><div>     p = ngx_http_map_uri_to_path(r, &path, &root, 0);</div><div>+    if (p == NULL) {</div><div>+        return NGX_HTTP_INTERNAL_SERVER_ERROR;</div><div>+    }</div><div> </div><div>     *(p - 1) = '\0';</div><div>     r->uri.len--;</div><div>@@ -666,7 +674,9 @@</div><div> </div><div> overwrite_done:</div><div> </div><div>-    ngx_http_map_uri_to_path(r, &path, &root, 0);</div><div>+    if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {</div><div>+        return NGX_HTTP_INTERNAL_SERVER_ERROR;</div><div>+    }</div><div> </div><div>     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,</div><div>                    "http copy from: \"%s\"", path.data);</div><div>@@ -674,7 +684,9 @@</div><div>     uri = r->uri;</div><div>     r->uri = duri;</div><div> </div><div>-    ngx_http_map_uri_to_path(r, &copy.path, &root, 0);</div><div>+    if (ngx_http_map_uri_to_path(r, &copy.path, &root, 0) == NULL) {</div><div>+        return NGX_HTTP_INTERNAL_SERVER_ERROR;</div><div>+    }</div><div> </div><div>     r->uri = uri;</div><div> </div><div><br></div></div><br><br><span title="neteasefooter"><span id="netease_mail_footer"></span></span>