commit 88d9289f82e0992727e81b36667936b7187b214f
author Maxim Dounin <mdounin@mdounin.ru> Fri Jul 18 20:02:11 2014 +0400
committer Maxim Dounin <mdounin@mdounin.ru> Fri Jul 18 20:02:11 2014 +0400
tree 2ed55fd3d6cd879f1c4cc67a6f587826a8158d7d
parent 7e52432a0518ab5abe35478aacdac4ddda05c5e5

Reset of r->uri.len on URI parsing errors.

This ensures that debug logging and the $uri variable (if used in
400 Bad Request processing) will not try to access uninitialized
memory.

Found by Sergey Bobrov.

src/http/ngx_http_request.c

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 4bf9d1f..845ada3 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1071,6 +1071,8 @@
         cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
 
         if (ngx_http_parse_complex_uri(r, cscf->merge_slashes) != NGX_OK) {
+            r->uri.len = 0;
+
             ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
                           "client sent invalid request");
             ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);