[nginx] Fixed buffer over-read while logging invalid request headers.
Valentin Bartenev
vbart at nginx.com
Wed Feb 24 13:05:37 UTC 2016
details: http://hg.nginx.org/nginx/rev/71edd9192f24
branches:
changeset: 6409:71edd9192f24
user: Valentin Bartenev <vbart at nginx.com>
date: Wed Feb 24 16:01:23 2016 +0300
description:
Fixed buffer over-read while logging invalid request headers.
Since 667aaf61a778 (1.1.17) the ngx_http_parse_header_line() function can return
NGX_HTTP_PARSE_INVALID_HEADER when a header contains NUL character. In this
case the r->header_end pointer isn't properly initialized, but the log message
in ngx_http_process_request_headers() hasn't been adjusted. It used the pointer
in size calculation, which might result in up to 2k buffer over-read.
Found with afl-fuzz.
diffstat:
src/http/ngx_http_request.c | 7 +++----
1 files changed, 3 insertions(+), 4 deletions(-)
diffs (19 lines):
diff -r cfc3cfa434ec -r 71edd9192f24 src/http/ngx_http_request.c
--- a/src/http/ngx_http_request.c Fri Feb 19 18:13:54 2016 +0300
+++ b/src/http/ngx_http_request.c Wed Feb 24 16:01:23 2016 +0300
@@ -1351,12 +1351,11 @@ ngx_http_process_request_headers(ngx_eve
continue;
}
- /* rc == NGX_HTTP_PARSE_INVALID_HEADER: "\r" is not followed by "\n" */
+ /* rc == NGX_HTTP_PARSE_INVALID_HEADER */
ngx_log_error(NGX_LOG_INFO, c->log, 0,
- "client sent invalid header line: \"%*s\\r...\"",
- r->header_end - r->header_name_start,
- r->header_name_start);
+ "client sent invalid header line");
+
ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
return;
}
More information about the nginx-devel
mailing list