Core: fixed port handling in ngx_parse_inet6_url(). This fixes buffer over-read when no port is specified in cases similar to 5df5d7d771f6, and catches missing port separator.
diff --git a/src/core/ngx_inet.c b/src/core/ngx_inet.c index 33b303d..d5b7cf9 100644 --- a/src/core/ngx_inet.c +++ b/src/core/ngx_inet.c
@@ -861,7 +861,12 @@ last = uri; } - if (*port == ':') { + if (port < last) { + if (*port != ':') { + u->err = "invalid host"; + return NGX_ERROR; + } + port++; len = last - port;