| commit | 668bf2e0951daf322293beb5da95656f9c02eb72 | [log] [tgz] |
|---|---|---|
| author | Vladimir Homutov <vl@nginx.com> | Wed Jul 06 14:33:40 2016 +0300 |
| committer | Vladimir Homutov <vl@nginx.com> | Wed Jul 06 14:33:40 2016 +0300 |
| tree | e401444fe5692dd1d84f423f994ee2bf7bc70b32 | |
| parent | 39c1d594fbd636db1447f5da89638224650eec6e [diff] |
Fixed regex captures handling without PCRE. If PCRE is disabled, captures were treated as normal variables in ngx_http_script_compile(), while code calculating flushes array length in ngx_http_compile_complex_value() did not account captures as variables. This could lead to write outside of the array boundary when setting last element to -1. Found with AddressSanitizer.