[nginx] svn commit: r4955 - in branches/stable-1.2: . src/http/modules

[mdounin at mdounin.ru]

Author: mdounin
Date: 2012-12-10 17:51:10 +0000 (Mon, 10 Dec 2012)
New Revision: 4955
URL: http://trac.nginx.org/nginx/changeset/4955/nginx

Log:
Merge of r4919: fixed segfault on PUT in dav module.

Dav: fixed segfault on PUT if body was already read (ticket #238).

If request body reading happens with different options it's possible
that there will be no r->request_body->temp_file available (or even
no r->request_body available if body was discarded).  Return internal
server error in this case instead of committing suicide by dereferencing
a null pointer.


Modified:
   branches/stable-1.2/
   branches/stable-1.2/src/http/modules/ngx_http_dav_module.c

Index: branches/stable-1.2
===================================================================
--- branches/stable-1.2	2012-12-10 17:46:51 UTC (rev 4954)
+++ branches/stable-1.2	2012-12-10 17:51:10 UTC (rev 4955)

Property changes on: branches/stable-1.2
___________________________________________________________________
Modified: svn:mergeinfo
## -1 +1 ##
-/trunk:4611-4632,4636-4657,4671-4672,4674-4676,4682,4684-4699,4704-4706,4713,4736-4741,4754,4756-4771,4775,4777-4780,4782-4785,4795,4811-4820,4822-4824,4828-4835,4840-4844,4865-4872,4885-4887,4890-4896,4913-4918
+/trunk:4611-4632,4636-4657,4671-4672,4674-4676,4682,4684-4699,4704-4706,4713,4736-4741,4754,4756-4771,4775,4777-4780,4782-4785,4795,4811-4820,4822-4824,4828-4835,4840-4844,4865-4872,4885-4887,4890-4896,4913-4919
\ No newline at end of property
Modified: branches/stable-1.2/src/http/modules/ngx_http_dav_module.c
===================================================================
--- branches/stable-1.2/src/http/modules/ngx_http_dav_module.c	2012-12-10 17:46:51 UTC (rev 4954)
+++ branches/stable-1.2/src/http/modules/ngx_http_dav_module.c	2012-12-10 17:51:10 UTC (rev 4955)
@@ -209,6 +209,11 @@
     ngx_ext_rename_file_t     ext;
     ngx_http_dav_loc_conf_t  *dlcf;
 
+    if (r->request_body == NULL || r->request_body->temp_file == NULL) {
+        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+        return;
+    }
+
     ngx_http_map_uri_to_path(r, &path, &root, 0);
 
     path.len--;