diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2014-07-18 20:02:11 +0400 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2014-07-18 20:02:11 +0400 |
| commit | 88d9289f82e0992727e81b36667936b7187b214f (patch) | |
| tree | 2ed55fd3d6cd879f1c4cc67a6f587826a8158d7d /src/http/ngx_http_request.c | |
| parent | 7e52432a0518ab5abe35478aacdac4ddda05c5e5 (diff) | |
| download | nginx-88d9289f82e0992727e81b36667936b7187b214f.tar.gz nginx-88d9289f82e0992727e81b36667936b7187b214f.zip | |
Reset of r->uri.len on URI parsing errors.
This ensures that debug logging and the $uri variable (if used in
400 Bad Request processing) will not try to access uninitialized
memory.
Found by Sergey Bobrov.
Diffstat (limited to 'src/http/ngx_http_request.c')
| -rw-r--r-- | src/http/ngx_http_request.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index 4bf9d1fcf..845ada322 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -1071,6 +1071,8 @@ ngx_http_process_request_uri(ngx_http_request_t *r) cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module); if (ngx_http_parse_complex_uri(r, cscf->merge_slashes) != NGX_OK) { + r->uri.len = 0; + ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, "client sent invalid request"); ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); |