From fd044c8ce8ce2a4c6dc191c53d4d3b977bc6a0bb Mon Sep 17 00:00:00 2001
From: Ruslan Ermilov <ru@nginx.com>
Date: Tue, 23 Aug 2016 15:57:29 +0300
Subject: [PATCH] Geo: fixed overflow when iterating over ranges.

---
 src/http/modules/ngx_http_geo_module.c | 12 ++++++++++--
 src/stream/ngx_stream_geo_module.c     | 12 ++++++++++--
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/src/http/modules/ngx_http_geo_module.c b/src/http/modules/ngx_http_geo_module.c
index 53e89692d..af061af81 100644
--- a/src/http/modules/ngx_http_geo_module.c
+++ b/src/http/modules/ngx_http_geo_module.c
@@ -946,7 +946,9 @@ ngx_http_geo_add_range(ngx_conf_t *cf, ngx_http_geo_conf_ctx_t *ctx,
 
     next:
 
-        continue;
+        if (h == 0xffff) {
+            break;
+        }
     }
 
     return NGX_CONF_OK;
@@ -985,7 +987,7 @@ ngx_http_geo_delete_range(ngx_conf_t *cf, ngx_http_geo_conf_ctx_t *ctx,
 
         if (a == NULL) {
             warn = 1;
-            continue;
+            goto next;
         }
 
         range = a->elts;
@@ -1010,6 +1012,12 @@ ngx_http_geo_delete_range(ngx_conf_t *cf, ngx_http_geo_conf_ctx_t *ctx,
 
             warn = 1;
         }
+
+    next:
+
+        if (h == 0xffff) {
+            break;
+        }
     }
 
     return warn;
diff --git a/src/stream/ngx_stream_geo_module.c b/src/stream/ngx_stream_geo_module.c
index 32fb9c0f4..3bdeff723 100644
--- a/src/stream/ngx_stream_geo_module.c
+++ b/src/stream/ngx_stream_geo_module.c
@@ -896,7 +896,9 @@ ngx_stream_geo_add_range(ngx_conf_t *cf, ngx_stream_geo_conf_ctx_t *ctx,
 
     next:
 
-        continue;
+        if (h == 0xffff) {
+            break;
+        }
     }
 
     return NGX_CONF_OK;
@@ -935,7 +937,7 @@ ngx_stream_geo_delete_range(ngx_conf_t *cf, ngx_stream_geo_conf_ctx_t *ctx,
 
         if (a == NULL) {
             warn = 1;
-            continue;
+            goto next;
         }
 
         range = a->elts;
@@ -960,6 +962,12 @@ ngx_stream_geo_delete_range(ngx_conf_t *cf, ngx_stream_geo_conf_ctx_t *ctx,
 
             warn = 1;
         }
+
+    next:
+
+        if (h == 0xffff) {
+            break;
+        }
     }
 
     return warn;