Mercurial > hg > nginx
view src/core/ngx_slab.h @ 6287:4ccb37b04454
Fixed ngx_parse_time() out of bounds access (ticket #821).
The code failed to ensure that "s" is within the buffer passed for
parsing when checking for "ms", and this resulted in unexpected errors when
parsing non-null-terminated strings with trailing "m". The bug manifested
itself when the expires directive was used with variables.
Found by Roman Arutyunyan.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Fri, 30 Oct 2015 21:43:30 +0300 |
parents | 25ade23cf281 |
children | 99770a5ea14f |
line wrap: on
line source
/* * Copyright (C) Igor Sysoev * Copyright (C) Nginx, Inc. */ #ifndef _NGX_SLAB_H_INCLUDED_ #define _NGX_SLAB_H_INCLUDED_ #include <ngx_config.h> #include <ngx_core.h> typedef struct ngx_slab_page_s ngx_slab_page_t; struct ngx_slab_page_s { uintptr_t slab; ngx_slab_page_t *next; uintptr_t prev; }; typedef struct { ngx_shmtx_sh_t lock; size_t min_size; size_t min_shift; ngx_slab_page_t *pages; ngx_slab_page_t *last; ngx_slab_page_t free; u_char *start; u_char *end; ngx_shmtx_t mutex; u_char *log_ctx; u_char zero; unsigned log_nomem:1; void *data; void *addr; } ngx_slab_pool_t; void ngx_slab_init(ngx_slab_pool_t *pool); void *ngx_slab_alloc(ngx_slab_pool_t *pool, size_t size); void *ngx_slab_alloc_locked(ngx_slab_pool_t *pool, size_t size); void *ngx_slab_calloc(ngx_slab_pool_t *pool, size_t size); void *ngx_slab_calloc_locked(ngx_slab_pool_t *pool, size_t size); void ngx_slab_free(ngx_slab_pool_t *pool, void *p); void ngx_slab_free_locked(ngx_slab_pool_t *pool, void *p); #endif /* _NGX_SLAB_H_INCLUDED_ */