From 28f62b667292898c163c83a682aec2b51c36eb0b Mon Sep 17 00:00:00 2001 From: Hakase Date: Fri, 19 Jul 2019 08:47:57 +0900 Subject: [PATCH] Latest update - 7540 --- src/core/ngx_hash.c | 30 +++++++++++++++---- src/http/modules/ngx_http_ssi_filter_module.c | 4 +-- .../modules/ngx_http_xslt_filter_module.c | 6 ++-- src/http/modules/perl/nginx.xs | 1 - src/http/ngx_http_upstream.c | 29 ++++++++++++++++-- src/http/v2/ngx_http_v2_filter_module.c | 6 ++++ 6 files changed, 61 insertions(+), 15 deletions(-) diff --git a/src/core/ngx_hash.c b/src/core/ngx_hash.c index 1944c7a..d684e70 100644 --- a/src/core/ngx_hash.c +++ b/src/core/ngx_hash.c @@ -265,6 +265,14 @@ ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts) return NGX_ERROR; } + if (hinit->bucket_size > 65536 - ngx_cacheline_size) { + ngx_log_error(NGX_LOG_EMERG, hinit->pool->log, 0, + "could not build %s, too large " + "%s_bucket_size: %i", + hinit->name, hinit->name, hinit->bucket_size); + return NGX_ERROR; + } + for (n = 0; n < nelts; n++) { if (hinit->bucket_size < NGX_HASH_ELT_SIZE(&names[n]) + sizeof(void *)) { @@ -300,17 +308,19 @@ ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts) } key = names[n].key_hash % size; - test[key] = (u_short) (test[key] + NGX_HASH_ELT_SIZE(&names[n])); + len = test[key] + NGX_HASH_ELT_SIZE(&names[n]); #if 0 ngx_log_error(NGX_LOG_ALERT, hinit->pool->log, 0, - "%ui: %ui %ui \"%V\"", - size, key, test[key], &names[n].key); + "%ui: %ui %uz \"%V\"", + size, key, len, &names[n].key); #endif - if (test[key] > (u_short) bucket_size) { + if (len > bucket_size) { goto next; } + + test[key] = (u_short) len; } goto found; @@ -341,7 +351,17 @@ found: } key = names[n].key_hash % size; - test[key] = (u_short) (test[key] + NGX_HASH_ELT_SIZE(&names[n])); + len = test[key] + NGX_HASH_ELT_SIZE(&names[n]); + + if (len > 65536 - ngx_cacheline_size) { + ngx_log_error(NGX_LOG_EMERG, hinit->pool->log, 0, + "could not build %s, you should " + "increase %s_max_size: %i", + hinit->name, hinit->name, hinit->max_size); + return NGX_ERROR; + } + + test[key] = (u_short) len; } len = 0; diff --git a/src/http/modules/ngx_http_ssi_filter_module.c b/src/http/modules/ngx_http_ssi_filter_module.c index d608df9..6737965 100644 --- a/src/http/modules/ngx_http_ssi_filter_module.c +++ b/src/http/modules/ngx_http_ssi_filter_module.c @@ -1254,9 +1254,9 @@ ngx_http_ssi_parse(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx) case '-': state = ssi_error_end0_state; - ctx->param->key.data[ctx->param->key.len++] = ch; ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, - "invalid \"%V\" parameter in \"%V\" SSI command", + "unexpected \"-\" symbol after \"%V\" " + "parameter in \"%V\" SSI command", &ctx->param->key, &ctx->command); break; diff --git a/src/http/modules/ngx_http_xslt_filter_module.c b/src/http/modules/ngx_http_xslt_filter_module.c index ea7ce2a..b2f107d 100644 --- a/src/http/modules/ngx_http_xslt_filter_module.c +++ b/src/http/modules/ngx_http_xslt_filter_module.c @@ -628,7 +628,7 @@ static ngx_int_t ngx_http_xslt_params(ngx_http_request_t *r, ngx_http_xslt_filter_ctx_t *ctx, ngx_array_t *params, ngx_uint_t final) { - u_char *p, *last, *value, *dst, *src, **s; + u_char *p, *value, *dst, *src, **s; size_t len; ngx_uint_t i; ngx_str_t string; @@ -698,8 +698,6 @@ ngx_http_xslt_params(ngx_http_request_t *r, ngx_http_xslt_filter_ctx_t *ctx, ngx_memcpy(p, string.data, string.len + 1); } - last = p + string.len; - while (p && *p) { value = p; @@ -729,7 +727,7 @@ ngx_http_xslt_params(ngx_http_request_t *r, ngx_http_xslt_filter_ctx_t *ctx, *p++ = '\0'; } else { - len = last - value; + len = ngx_strlen(value); } ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, diff --git a/src/http/modules/perl/nginx.xs b/src/http/modules/perl/nginx.xs index 309b7cb..caf7c08 100644 --- a/src/http/modules/perl/nginx.xs +++ b/src/http/modules/perl/nginx.xs @@ -933,7 +933,6 @@ internal_redirect(r, uri) ngx_http_request_t *r; ngx_http_perl_ctx_t *ctx; SV *uri; - ngx_uint_t i; ngx_http_perl_set_request(r, ctx); diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c index ffb09a9..89e1319 100644 --- a/src/http/ngx_http_upstream.c +++ b/src/http/ngx_http_upstream.c @@ -3334,6 +3334,7 @@ ngx_http_upstream_process_upgraded(ngx_http_request_t *r, size_t size; ssize_t n; ngx_buf_t *b; + ngx_uint_t flags; ngx_connection_t *c, *downstream, *upstream, *dst, *src; ngx_http_upstream_t *u; ngx_http_core_loc_conf_t *clcf; @@ -3472,7 +3473,14 @@ ngx_http_upstream_process_upgraded(ngx_http_request_t *r, ngx_del_timer(upstream->write); } - if (ngx_handle_read_event(upstream->read, 0) != NGX_OK) { + if (upstream->read->eof || upstream->read->error) { + flags = NGX_CLOSE_EVENT; + + } else { + flags = 0; + } + + if (ngx_handle_read_event(upstream->read, flags) != NGX_OK) { ngx_http_upstream_finalize_request(r, u, NGX_ERROR); return; } @@ -3491,7 +3499,14 @@ ngx_http_upstream_process_upgraded(ngx_http_request_t *r, return; } - if (ngx_handle_read_event(downstream->read, 0) != NGX_OK) { + if (downstream->read->eof || downstream->read->error) { + flags = NGX_CLOSE_EVENT; + + } else { + flags = 0; + } + + if (ngx_handle_read_event(downstream->read, flags) != NGX_OK) { ngx_http_upstream_finalize_request(r, u, NGX_ERROR); return; } @@ -3563,6 +3578,7 @@ ngx_http_upstream_process_non_buffered_request(ngx_http_request_t *r, ssize_t n; ngx_buf_t *b; ngx_int_t rc; + ngx_uint_t flags; ngx_connection_t *downstream, *upstream; ngx_http_upstream_t *u; ngx_http_core_loc_conf_t *clcf; @@ -3666,7 +3682,14 @@ ngx_http_upstream_process_non_buffered_request(ngx_http_request_t *r, ngx_del_timer(downstream->write); } - if (ngx_handle_read_event(upstream->read, 0) != NGX_OK) { + if (upstream->read->eof || upstream->read->error) { + flags = NGX_CLOSE_EVENT; + + } else { + flags = 0; + } + + if (ngx_handle_read_event(upstream->read, flags) != NGX_OK) { ngx_http_upstream_finalize_request(r, u, NGX_ERROR); return; } diff --git a/src/http/v2/ngx_http_v2_filter_module.c b/src/http/v2/ngx_http_v2_filter_module.c index 51750b0..6ba234e 100644 --- a/src/http/v2/ngx_http_v2_filter_module.c +++ b/src/http/v2/ngx_http_v2_filter_module.c @@ -1420,6 +1420,12 @@ ngx_http_v2_send_chain(ngx_connection_t *fc, ngx_chain_t *in, off_t limit) if (in == NULL || stream->out_closed) { + if (size) { + ngx_log_error(NGX_LOG_ERR, fc->log, 0, + "output on closed stream"); + return NGX_CHAIN_ERROR; + } + if (stream->queued) { fc->write->active = 1; fc->write->ready = 0;