aboutsummaryrefslogtreecommitdiff
path: root/src/http/modules/ngx_http_referer_module.c
diff options
context:
space:
mode:
authorValentin Bartenev <vbart@nginx.com>2013-08-29 22:35:54 +0400
committerValentin Bartenev <vbart@nginx.com>2013-08-29 22:35:54 +0400
commit6d7ec5009a585fbbfa01a1b02fe7116957bcf5f0 (patch)
treecfd2ced4ec9824599e8d5d26bd5fa9eef391d9bb /src/http/modules/ngx_http_referer_module.c
parente4209c02695eeff839d8e7aa807b62fe502bb4e8 (diff)
downloadnginx-6d7ec5009a585fbbfa01a1b02fe7116957bcf5f0.tar.gz
nginx-6d7ec5009a585fbbfa01a1b02fe7116957bcf5f0.zip
Referer: fixed hostname buffer overflow check.
Because of premature check the effective buffer size was 255 symbols while the buffer is able to handle 256.
Diffstat (limited to 'src/http/modules/ngx_http_referer_module.c')
-rw-r--r--src/http/modules/ngx_http_referer_module.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/src/http/modules/ngx_http_referer_module.c b/src/http/modules/ngx_http_referer_module.c
index a51176713..b417eb227 100644
--- a/src/http/modules/ngx_http_referer_module.c
+++ b/src/http/modules/ngx_http_referer_module.c
@@ -178,12 +178,12 @@ valid_scheme:
break;
}
- buf[i] = ngx_tolower(*p);
- key = ngx_hash(key, buf[i++]);
-
if (i == 256) {
goto invalid;
}
+
+ buf[i] = ngx_tolower(*p);
+ key = ngx_hash(key, buf[i++]);
}
uri = ngx_hash_find_combined(&rlcf->hash, key, buf, p - ref);