Dav: ngx_http_map_uri_to_path() errors were not checked.
Once error occured, it could lead to use uninitialized variables to log,
even more segmentation fault.
diff --git a/src/http/modules/ngx_http_dav_module.c b/src/http/modules/ngx_http_dav_module.c
index e7f9e9a..529aba5 100644
--- a/src/http/modules/ngx_http_dav_module.c
+++ b/src/http/modules/ngx_http_dav_module.c
@@ -212,7 +212,10 @@
return;
}
- ngx_http_map_uri_to_path(r, &path, &root, 0);
+ if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {
+ ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+ return;
+ }
path.len--;
@@ -320,7 +323,9 @@
ok:
- ngx_http_map_uri_to_path(r, &path, &root, 0);
+ if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {
+ return NGX_HTTP_INTERNAL_SERVER_ERROR;
+ }
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
"http delete filename: \"%s\"", path.data);
@@ -488,6 +493,9 @@
}
p = ngx_http_map_uri_to_path(r, &path, &root, 0);
+ if (p == NULL) {
+ return NGX_HTTP_INTERNAL_SERVER_ERROR;
+ }
*(p - 1) = '\0';
r->uri.len--;
@@ -666,7 +674,9 @@
overwrite_done:
- ngx_http_map_uri_to_path(r, &path, &root, 0);
+ if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {
+ return NGX_HTTP_INTERNAL_SERVER_ERROR;
+ }
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
"http copy from: \"%s\"", path.data);
@@ -674,7 +684,9 @@
uri = r->uri;
r->uri = duri;
- ngx_http_map_uri_to_path(r, ©.path, &root, 0);
+ if (ngx_http_map_uri_to_path(r, ©.path, &root, 0) == NULL) {
+ return NGX_HTTP_INTERNAL_SERVER_ERROR;
+ }
r->uri = uri;