Fijxu/nginx-quic
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fixed regex captures handling without PCRE.

Browse source 
If PCRE is disabled, captures were treated as normal variables in
ngx_http_script_compile(), while code calculating flushes array length in
ngx_http_compile_complex_value() did not account captures as variables.
This could lead to write outside of the array boundary when setting
last element to -1.

Found with AddressSanitizer.
This commit is contained in:
Vladimir Homutov 2016-07-06 14:33:40 +03:00
parent 9022f6a3e0
commit 4d22d48e37
2 changed files with 16 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/http/ngx_http_script.c
View file

@ -350,11 +350,9 @@ ngx_http_script_compile(ngx_http_script_compile_t *sc)
goto invalid_variable;
}
#if (NGX_PCRE)
{
ngx_uint_t n;
if (sc->source->data[i] >= '1' && sc->source->data[i] <= '9') {
#if (NGX_PCRE)
ngx_uint_t n;
n = sc->source->data[i] - '0';
@ -371,9 +369,13 @@ ngx_http_script_compile(ngx_http_script_compile_t *sc)
i++;
continue;
}
}
#else
ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0,
"using variable \"$%c\" requires "
"PCRE library", sc->source->data[i]);
return NGX_ERROR;
#endif
}
if (sc->source->data[i] == '{') {
bracket = 1;

14
src/stream/ngx_stream_script.c
View file

@ -282,11 +282,9 @@ ngx_stream_script_compile(ngx_stream_script_compile_t *sc)
goto invalid_variable;
}
#if (NGX_PCRE)
{
ngx_uint_t n;
if (sc->source->data[i] >= '1' && sc->source->data[i] <= '9') {
#if (NGX_PCRE)
ngx_uint_t n;
n = sc->source->data[i] - '0';
@ -297,9 +295,13 @@ ngx_stream_script_compile(ngx_stream_script_compile_t *sc)
i++;
continue;
}
}
#else
ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0,
"using variable \"$%c\" requires "
"PCRE library", sc->source->data[i]);
return NGX_ERROR;
#endif
}
if (sc->source->data[i] == '{') {
bracket = 1;