diff options
| author | nginx <nginx@nginx.org> | 2015-04-07 16:06:25 +0000 |
|---|---|---|
| committer | Jon Kolb <kolbyjack@gmail.com> | 2015-04-07 16:06:25 +0000 |
| commit | 72e45e044fbfeab626688498132d6a3bed24bf70 (patch) | |
| tree | df621b5510d9d830b1a79bb006c2126e1346d650 /src/http/ngx_http_parse.c | |
| parent | ab9c4cd3a4ed13f61ae572c15042df84d5fb9418 (diff) | |
| download | nginx-1.6.tar.gz | |
*) Feature: now the "tcp_nodelay" directive works with SPDY connections.
*) Bugfix: in error handling.
Thanks to Yichun Zhang and Daniil Bondarev.
*) Bugfix: alerts "header already sent" appeared in logs if the
"post_action" directive was used; the bug had appeared in 1.5.4.
*) Bugfix: alerts "sem_post() failed" might appear in logs.
*) Bugfix: in hash table handling.
Thanks to Chris West.
*) Bugfix: in integer overflow handling.
Thanks to Régis Leroy.
Diffstat (limited to 'src/http/ngx_http_parse.c')
| -rw-r--r-- | src/http/ngx_http_parse.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c index 02b4a0fd1..8d38a1920 100644 --- a/src/http/ngx_http_parse.c +++ b/src/http/ngx_http_parse.c @@ -2104,6 +2104,10 @@ ngx_http_parse_chunked(ngx_http_request_t *r, ngx_buf_t *b, goto invalid; case sw_chunk_size: + if (ctx->size > NGX_MAX_OFF_T_VALUE / 16) { + goto invalid; + } + if (ch >= '0' && ch <= '9') { ctx->size = ctx->size * 16 + (ch - '0'); break; @@ -2253,6 +2257,10 @@ data: ctx->state = state; b->pos = pos; + if (ctx->size > NGX_MAX_OFF_T_VALUE - 5) { + goto invalid; + } + switch (state) { case sw_chunk_start: @@ -2289,10 +2297,6 @@ data: } - if (ctx->size < 0 || ctx->length < 0) { - goto invalid; - } - return rc; done: |