Latest update - 7369

.hgtags

@@ -430,3 +430,4 @@ fb1212c7eca4c5328fe17d6cd95b010c67336aac release-1.13.9
 b234199c7ed8a156a6bb98f7ff58302c857c954f release-1.15.2
 28b3e17ca7eba1e6a0891afde0e4bc5bcc99c861 release-1.15.3
 49d49835653857daa418e68d6cbfed4958c78fca release-1.15.4
+f062e43d74fc2578bb100a9e82a953efa1eb9e4e release-1.15.5

docs/xml/nginx/changes.xml

@@ -5,6 +5,33 @@
 <change_log title="nginx">
 
 
+<changes ver="1.15.5" date="2018-10-02">
+
+<change type="bugfix">
+<para lang="ru">
+при использовании OpenSSL 1.1.0h и новее
+в рабочем процессе мог произойти segmentation fault;
+ошибка появилась в 1.15.4.
+</para>
+<para lang="en">
+a segmentation fault might occur in a worker process
+when using OpenSSL 1.1.0h or newer;
+the bug had appeared in 1.15.4.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+незначительных потенциальных ошибок.
+</para>
+<para lang="en">
+of minor potential bugs.
+</para>
+</change>
+
+</changes>
+
+
 <changes ver="1.15.4" date="2018-09-25">
 
 <change type="feature">

src/core/ngx_cycle.c

@@ -921,7 +921,8 @@ ngx_init_zone_pool(ngx_cycle_t *cycle, ngx_shm_zone_t *zn)
 
 #else
 
-    file = ngx_pnalloc(cycle->pool, cycle->lock_file.len + zn->shm.name.len);
+    file = ngx_pnalloc(cycle->pool,
+                       cycle->lock_file.len + zn->shm.name.len + 1);
     if (file == NULL) {
         return NGX_ERROR;
     }

src/event/ngx_event_openssl.c

@@ -350,10 +350,6 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
     SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
 #endif
 
-#ifdef SSL_OP_NO_RENEGOTIATION
-    SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_RENEGOTIATION);
-#endif
-
 #ifdef SSL_OP_PRIORITIZE_CHACHA
     SSL_CTX_set_options(ssl->ctx, SSL_OP_PRIORITIZE_CHACHA);
 #endif
@@ -1303,6 +1299,9 @@ ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags)
     } else {
         SSL_set_accept_state(sc->connection);
 
+#ifdef SSL_OP_NO_RENEGOTIATION
+        SSL_set_options(sc->connection, SSL_OP_NO_RENEGOTIATION);
+#endif
     }
 
     if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {

src/http/ngx_http_request.c

@@ -858,7 +858,7 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
         return (clcf->strict_sni) ? SSL_TLSEXT_ERR_ALERT_FATAL : SSL_TLSEXT_ERR_NOACK;
     }
 
-    if (c->ssl->renegotiation) {
+    if (c->ssl->handshaked) {
         return SSL_TLSEXT_ERR_NOACK;
     }
 
@@ -919,6 +919,10 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
 #endif
 
         SSL_set_options(ssl_conn, SSL_CTX_get_options(sscf->ssl.ctx));
+
+#ifdef SSL_OP_NO_RENEGOTIATION
+        SSL_set_options(ssl_conn, SSL_OP_NO_RENEGOTIATION);
+#endif
     }
 
     return SSL_TLSEXT_ERR_OK;