commit 0518b16c6c9c33dc2d983615de3e71d3ea1c59a0
author Piotr Sikora <piotrsikora@google.com> Fri Feb 26 17:30:27 2016 -0800
committer Piotr Sikora <piotrsikora@google.com> Fri Feb 26 17:30:27 2016 -0800
tree 7eda6be9f9564655caad621664e24f1a06b4e0f5
parent a08e89b4f35916adc0c971088d0d8d1353ea4cd7

Core: allow strings without null-termination in ngx_parse_url().

This fixes buffer over-read while using variables in the "proxy_pass",
"fastcgi_pass", "scgi_pass", and "uwsgi_pass" directives, where result
of string evaluation isn't null-terminated.

Found with MemorySanitizer.

Signed-off-by: Piotr Sikora <piotrsikora@google.com>

src/core/ngx_inet.c

diff --git a/src/core/ngx_inet.c b/src/core/ngx_inet.c
index 96a04fd..3bbadb8 100644
--- a/src/core/ngx_inet.c
+++ b/src/core/ngx_inet.c
@@ -529,14 +529,16 @@
 ngx_parse_url(ngx_pool_t *pool, ngx_url_t *u)
 {
     u_char  *p;
+    size_t   len;
 
     p = u->url.data;
+    len = u->url.len;
 
-    if (ngx_strncasecmp(p, (u_char *) "unix:", 5) == 0) {
+    if (len >= 5 && ngx_strncasecmp(p, (u_char *) "unix:", 5) == 0) {
         return ngx_parse_unix_domain_url(pool, u);
     }
 
-    if (p[0] == '[') {
+    if (len && p[0] == '[') {
         return ngx_parse_inet6_url(pool, u);
     }