diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2015-09-11 17:04:40 +0300 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2015-09-11 17:04:40 +0300 |
| commit | 2c9691431229bfe33e81c5a03a70792548b28e22 (patch) | |
| tree | 557e6da9e3ef3bce3d90446f2b7633cc49557f21 /src | |
| parent | 7930a6c44279315140955fac230cf5305fc3c550 (diff) | |
| download | nginx-2c9691431229bfe33e81c5a03a70792548b28e22.tar.gz nginx-2c9691431229bfe33e81c5a03a70792548b28e22.zip | |
Core: fixed segfault with null in wildcard hash names.
A configuration like
server { server_name .foo^@; }
server { server_name .foo; }
resulted in a segmentation fault during construction of server names hash.
Reported by Markus Linnala.
Found with afl-fuzz.
Diffstat (limited to 'src')
| -rw-r--r-- | src/core/ngx_hash.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/core/ngx_hash.c b/src/core/ngx_hash.c index 1a5d0be2e..151e64304 100644 --- a/src/core/ngx_hash.c +++ b/src/core/ngx_hash.c @@ -743,6 +743,10 @@ ngx_hash_add_key(ngx_hash_keys_arrays_t *ha, ngx_str_t *key, void *value, if (key->data[i] == '.' && key->data[i + 1] == '.') { return NGX_DECLINED; } + + if (key->data[i] == '\0') { + return NGX_DECLINED; + } } if (key->len > 1 && key->data[0] == '.') { |