]> git.kaiwu.me - nginx.git/commit
Proxy: fixed segfault in URI change.
authorSergey Kandaurov <pluknet@nginx.com>
Mon, 24 Nov 2025 11:57:09 +0000 (15:57 +0400)
committerSergey Kandaurov <s.kandaurov@f5.com>
Tue, 23 Dec 2025 18:40:33 +0000 (22:40 +0400)
commiteec047c936347bb1ebb6266a4c83f31fa9c78e24
tree5e78c00e4421c5fc34d8dc2c97fe622b9d20c9d9
parent2b502468588835e479fcd76a2cc0d00394f2c32c
Proxy: fixed segfault in URI change.

If request URI was shorter than location prefix, as after replacement
with try_files, location length was used to copy the remaining URI part
leading to buffer overread.

The fix is to replace full request URI in this case.  In the following
configuration, request "/123" is changed to "/" when sent to backend.

    location /1234 {
        try_files /123 =404;
        proxy_pass http://127.0.0.1:8080/;
    }

Closes #983 on GitHub.
src/http/modules/ngx_http_proxy_module.c