From: Maxim Dounin <mdounin@mdounin.ru>
Date: Wed, 21 Nov 2012 00:51:37 +0000 (+0000)
Subject: Dav: fixed segfault on PUT if body was already read (ticket #238).
X-Git-Tag: release-1.3.9~22
X-Git-Url: http://www.kaiwu.me/postgresql/commit/?a=commitdiff_plain;h=248bc41893a9f8b0a0b0b1b231d56def837de080;p=nginx.git

Dav: fixed segfault on PUT if body was already read (ticket #238).

If request body reading happens with different options it's possible
that there will be no r->request_body->temp_file available (or even
no r->request_body available if body was discarded).  Return internal
server error in this case instead of committing suicide by dereferencing
a null pointer.
---

diff --git a/src/http/modules/ngx_http_dav_module.c b/src/http/modules/ngx_http_dav_module.c
index dbb17ac30..a97c60e44 100644
--- a/src/http/modules/ngx_http_dav_module.c
+++ b/src/http/modules/ngx_http_dav_module.c
@@ -209,6 +209,11 @@ ngx_http_dav_put_handler(ngx_http_request_t *r)
     ngx_ext_rename_file_t     ext;
     ngx_http_dav_loc_conf_t  *dlcf;
 
+    if (r->request_body == NULL || r->request_body->temp_file == NULL) {
+        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+        return;
+    }
+
     ngx_http_map_uri_to_path(r, &path, &root, 0);
 
     path.len--;