fix segfault when $host is used and

*) request is "GET http://host" without CR or LF, or timed out
*) request is "GET      http://host" with a large blank space

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 2c1ac956648b701dee5a6eeb739e8b4dbfa78e67..f6dcd6a5693181579e45c6b24b762fca214f00ac 100644 (file)
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1104,7 +1104,9 @@ ngx_http_alloc_large_header_buffer(ngx_http_request_t *r,
 
         if (r->host_start) {
             r->host_start = new + (r->host_start - old);
-            r->host_end = new + (r->host_end - old);
+            if (r->host_end) {
+                r->host_end = new + (r->host_end - old);
+            }
         }
 
         if (r->port_start) {

diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
index c31defc4e789b6d81f6148972efb0d2a80779858..ab43638f61cd21c68f744f478c27a8ae609998e7 100644 (file)
--- a/src/http/ngx_http_variables.c
+++ b/src/http/ngx_http_variables.c
@@ -678,9 +678,13 @@ ngx_http_variable_host(ngx_http_request_t *r, ngx_http_variable_value_t *v,
             v->data = r->server_name.data;
         }
 
-    } else {
+    } else if (r->host_end) {
         v->len = r->host_end - r->host_start;
         v->data = r->host_start;
+
+    } else {
+        v->not_found = 1;
+        return NGX_OK;
     }
 
     v->valid = 1;