Mercurial > hg > nginx
diff src/http/ngx_http_variables.c @ 6851:8cd97c14b0e2
Limited recursion when evaluating variables.
Unlimited recursion might cause stack exhaustion in some misconfigurations.
author | Ruslan Ermilov <ru@nginx.com> |
---|---|
date | Wed, 21 Dec 2016 22:01:24 +0300 |
parents | b3b7e33083ac |
children | d2b2ff157da5 |
line wrap: on
line diff
--- a/src/http/ngx_http_variables.c Tue Dec 20 12:05:14 2016 +0300 +++ b/src/http/ngx_http_variables.c Wed Dec 21 22:01:24 2016 +0300 @@ -366,6 +366,9 @@ ngx_http_variable("1"); +static ngx_uint_t ngx_http_variable_depth = 100; + + ngx_http_variable_t * ngx_http_add_variable(ngx_conf_t *cf, ngx_str_t *name, ngx_uint_t flags) { @@ -517,9 +520,20 @@ v = cmcf->variables.elts; + if (ngx_http_variable_depth == 0) { + ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, + "cycle while evaluating variable \"%V\"", + &v[index].name); + return NULL; + } + + ngx_http_variable_depth--; + if (v[index].get_handler(r, &r->variables[index], v[index].data) == NGX_OK) { + ngx_http_variable_depth++; + if (v[index].flags & NGX_HTTP_VAR_NOCACHEABLE) { r->variables[index].no_cacheable = 1; } @@ -527,6 +541,8 @@ return &r->variables[index]; } + ngx_http_variable_depth++; + r->variables[index].valid = 0; r->variables[index].not_found = 1; @@ -568,17 +584,25 @@ if (v) { if (v->flags & NGX_HTTP_VAR_INDEXED) { return ngx_http_get_flushed_variable(r, v->index); - - } else { - - vv = ngx_palloc(r->pool, sizeof(ngx_http_variable_value_t)); - - if (vv && v->get_handler(r, vv, v->data) == NGX_OK) { - return vv; - } - + } + + if (ngx_http_variable_depth == 0) { + ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, + "cycle while evaluating variable \"%V\"", name); return NULL; } + + ngx_http_variable_depth--; + + vv = ngx_palloc(r->pool, sizeof(ngx_http_variable_value_t)); + + if (vv && v->get_handler(r, vv, v->data) == NGX_OK) { + ngx_http_variable_depth++; + return vv; + } + + ngx_http_variable_depth++; + return NULL; } vv = ngx_palloc(r->pool, sizeof(ngx_http_variable_value_t));