]> git.kaiwu.me - nginx.git/commit
Fixed ngx_parse_time() out of bounds access (ticket #821).
authorMaxim Dounin <mdounin@mdounin.ru>
Fri, 30 Oct 2015 18:43:30 +0000 (21:43 +0300)
committerMaxim Dounin <mdounin@mdounin.ru>
Fri, 30 Oct 2015 18:43:30 +0000 (21:43 +0300)
commitd4cd59c17b003dfbc121e48473dd2604e76c7fdf
tree4769f196ba264fbae36a6ebb74817d2e3dfe7fc2
parent440759bd6622c3db4ebf3ad60b497f0eaec203dd
Fixed ngx_parse_time() out of bounds access (ticket #821).

The code failed to ensure that "s" is within the buffer passed for
parsing when checking for "ms", and this resulted in unexpected errors when
parsing non-null-terminated strings with trailing "m".  The bug manifested
itself when the expires directive was used with variables.

Found by Roman Arutyunyan.
src/core/ngx_parse.c