tree 8be1916c9f4d828004ce934a83d0d97207cd327a
parent 6dbc33f8317e2a7a9596351f48f7914b5450779b
author Maxim Dounin <mdounin@mdounin.ru> 1331811703 +0000
committer Maxim Dounin <mdounin@mdounin.ru> 1331811703 +0000

Merge of r4530, r4531: null character fixes.

*) Fixed incorrect ngx_cpystrn() usage in ngx_http_*_process_header().

   This resulted in a disclosure of previously freed memory if upstream
   server returned specially crafted response, potentially exposing
   sensitive information.

   Reported by Matthew Daley.

*) Headers with null character are now rejected.

   Headers with NUL character aren't allowed by HTTP standard and may cause
   various security problems.  They are now unconditionally rejected.