Fixing memory allocations for NUL-terminated strings #1#16
Open
lonerr wants to merge 1 commit intoAirisX:masterfrom
Open
Fixing memory allocations for NUL-terminated strings #1#16lonerr wants to merge 1 commit intoAirisX:masterfrom
lonerr wants to merge 1 commit intoAirisX:masterfrom
Conversation
for "cookie_name". The strcat() call would write '\0' outside the allocated buffer. The current code also incorrectly matches any cookie whose name ends in "foo" if "set_cookie_flag foo ..." is specified. Both bugs fixed by rewriting the code that matches cookies by name. ngx_http_cookie_flag_filter_append() allocated not enough memory when editing cookie values. Generally, strings in nginx are not NUL-terminated, but there are some exceptions, including the values of request/response headers. While that assumption allows searching for substrings with ngx_strcasestrn(), the edited values were not NUL-terminated. This is fixed by allocating enough memory to have NUL-terminated strings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I'm submitting this patch on behalf of Ruslan Ermilov (ru@nginx.com),
who is an nginx developer. You can reach out to him directly in case
of any questions. Also, please note, that there are two possible
approaches to fixing the problem. This one is more straightforward
while the second one (next pull request) is more efficient.
Below is the author's original commit log:
ngx_http_cookie_flag_filter_handler() allocated not enough memory
for "cookie_name". The strcat() call would write '\0' outside the
allocated buffer. The current code also incorrectly matches any
cookie whose name ends in "foo" if "set_cookie_flag foo ..." is
specified. Both bugs fixed by rewriting the code that matches
cookies by name.
ngx_http_cookie_flag_filter_append() allocated not enough memory
when editing cookie values. Generally, strings in nginx are not
NUL-terminated, but there are some exceptions, including the
values of request/response headers. While that assumption allows
searching for substrings with ngx_strcasestrn(), the edited values
were not NUL-terminated. This is fixed by allocating enough memory
to have NUL-terminated strings.