Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixing memory allocations for NUL-terminated strings #2 #17

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

lonerr
Copy link

@lonerr lonerr commented Jul 8, 2020

I'm submitting this patch on behalf of Ruslan Ermilov (ru@nginx.com),
who is an nginx developer. You can reach out to him directly in case
of any questions. Also, please note, that there are two possible
approaches to fixing the problem. This one is more efficient
while the second one (previous pull request) is more straightforward.
Below is the author's original commit log:

ngx_http_cookie_flag_filter_handler() allocated not enough memory
for "cookie_name". The strcat() call would write '\0' outside the
allocated buffer. The current code also incorrectly matches any
cookie whose name ends in "foo" if "set_cookie_flag foo ..." is
specified. Both bugs fixed by rewriting the code that matches
cookies by name.

ngx_http_cookie_flag_filter_append() allocated not enough memory
when editing cookie values. Generally, strings in nginx are not
NUL-terminated, but there are some exceptions, including the
values of request/response headers. While that assumption allows
searching for substrings with ngx_strcasestrn(), the edited values
were not NUL-terminated. This is fixed by allocating enough memory
to have NUL-terminated strings.

for "cookie_name".  The strcat() call would write '\0' outside the
allocated buffer.  The current code also incorrectly matches any
cookie whose name ends in "foo" if "set_cookie_flag foo ..." is
specified.  Both bugs fixed by rewriting the code that matches
cookies by name.

ngx_http_cookie_flag_filter_append() allocated not enough memory
when editing cookie values.  Generally, strings in nginx are not
NUL-terminated, but there are some exceptions, including the
values of request/response headers.  While that assumption allows
searching for substrings with ngx_strcasestrn(), the edited values
were not NUL-terminated.  This is fixed by allocating enough memory
to have NUL-terminated strings.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant