Mercurial > hg > nginx
changeset 3287:e07630a9547d
fix segfault if there is single large_client_header_buffers
and a request line fills it completely
author | Igor Sysoev <igor@sysoev.ru> |
---|---|
date | Tue, 03 Nov 2009 18:12:20 +0000 |
parents | 7c80f584c3a9 |
children | d56c8b5df517 |
files | src/http/ngx_http_request.c |
diffstat | 1 files changed, 9 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/src/http/ngx_http_request.c Tue Nov 03 16:29:47 2009 +0000 +++ b/src/http/ngx_http_request.c Tue Nov 03 18:12:20 2009 +0000 @@ -954,9 +954,17 @@ } if (rv == NGX_DECLINED) { - len = r->header_in->end - r->header_name_start; p = r->header_name_start; + if (p == NULL) { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent too large request"); + ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); + return; + } + + len = r->header_in->end - p; + if (len > NGX_MAX_ERROR_STR - 300) { len = NGX_MAX_ERROR_STR - 300; p[len++] = '.'; p[len++] = '.'; p[len++] = '.';