diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2012-11-21 00:51:37 +0000 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2012-11-21 00:51:37 +0000 |
| commit | 248bc41893a9f8b0a0b0b1b231d56def837de080 (patch) | |
| tree | 613a760b795d9c2058e6850b4d06f7817bf9b37e /src | |
| parent | da130acfbe130ce655314ec128bcc1e5f0e334c6 (diff) | |
| download | nginx-248bc41893a9f8b0a0b0b1b231d56def837de080.tar.gz nginx-248bc41893a9f8b0a0b0b1b231d56def837de080.zip | |
Dav: fixed segfault on PUT if body was already read (ticket #238).
If request body reading happens with different options it's possible
that there will be no r->request_body->temp_file available (or even
no r->request_body available if body was discarded). Return internal
server error in this case instead of committing suicide by dereferencing
a null pointer.
Diffstat (limited to 'src')
| -rw-r--r-- | src/http/modules/ngx_http_dav_module.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/http/modules/ngx_http_dav_module.c b/src/http/modules/ngx_http_dav_module.c index dbb17ac30..a97c60e44 100644 --- a/src/http/modules/ngx_http_dav_module.c +++ b/src/http/modules/ngx_http_dav_module.c @@ -209,6 +209,11 @@ ngx_http_dav_put_handler(ngx_http_request_t *r) ngx_ext_rename_file_t ext; ngx_http_dav_loc_conf_t *dlcf; + if (r->request_body == NULL || r->request_body->temp_file == NULL) { + ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR); + return; + } + ngx_http_map_uri_to_path(r, &path, &root, 0); path.len--; |