commit ee8f3c8b37219ffccaba4f6df237b5c1a191af55
author Maxim Dounin <mdounin@mdounin.ru> Tue Feb 24 18:37:14 2015 +0300
committer Maxim Dounin <mdounin@mdounin.ru> Tue Feb 24 18:37:14 2015 +0300
tree 565c6519980a400dc6ba7dd66479b0ed4ad75b93
parent eff95dc1a5c125cfc218835ae9a73d4ab0b53a1d

Core: fixed potential buffer overrun when initializing hash.

Initial size as calculated from the number of elements may be bigger
than max_size.  If this happens, make sure to set size to max_size.

Reported by Chris West.

src/core/ngx_hash.c

diff --git a/src/core/ngx_hash.c b/src/core/ngx_hash.c
index 65ad839..e707c09 100644
--- a/src/core/ngx_hash.c
+++ b/src/core/ngx_hash.c
@@ -312,7 +312,7 @@
         continue;
     }
 
-    size--;
+    size = hinit->max_size;
 
     ngx_log_error(NGX_LOG_WARN, hinit->pool->log, 0,
                   "could not build optimal %s, you should increase "