Skip to content

Commit 72e45e0

Browse files
nginxkolbyjack
nginx
authored and
kolbyjack
committed
Changes with nginx 1.6.3 07 Apr 2015
 *) Feature: now the "tcp_nodelay" directive works with SPDY connections. *) Bugfix: in error handling. Thanks to Yichun Zhang and Daniil Bondarev. *) Bugfix: alerts "header already sent" appeared in logs if the "post_action" directive was used; the bug had appeared in 1.5.4. *) Bugfix: alerts "sem_post() failed" might appear in logs. *) Bugfix: in hash table handling. Thanks to Chris West. *) Bugfix: in integer overflow handling. Thanks to Régis Leroy.
1 parent ab9c4cd commit 72e45e0

17 files changed

+248
-88
lines changed

‎CHANGES

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,23 @@
11

2+
Changes with nginx 1.6.3 07 Apr 2015
3+
4+
*) Feature: now the "tcp_nodelay" directive works with SPDY connections.
5+
6+
*) Bugfix: in error handling.
7+
Thanks to Yichun Zhang and Daniil Bondarev.
8+
9+
*) Bugfix: alerts "header already sent" appeared in logs if the
10+
"post_action" directive was used; the bug had appeared in 1.5.4.
11+
12+
*) Bugfix: alerts "sem_post() failed" might appear in logs.
13+
14+
*) Bugfix: in hash table handling.
15+
Thanks to Chris West.
16+
17+
*) Bugfix: in integer overflow handling.
18+
Thanks to Régis Leroy.
19+
20+
221
Changes with nginx 1.6.2 16 Sep 2014
322

423
*) Security: it was possible to reuse SSL sessions in unrelated contexts

‎CHANGES.ru

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,24 @@
11

2+
Изменения в nginx 1.6.3 07.04.2015
3+
4+
*) Добавление: теперь директива tcp_nodelay работает для
5+
SPDY-соединений.
6+
7+
*) Исправление: в обработке ошибок.
8+
Спасибо Yichun Zhang и Даниилу Бондареву.
9+
10+
*) Исправление: при использовании директивы post_action в лог писались
11+
сообщения "header already sent"; ошибка появилась в nginx 1.5.4.
12+
13+
*) Исправление: в лог могли писаться сообщения "sem_post() failed".
14+
15+
*) Исправление: в обработке хэш-таблиц.
16+
Спасибо Chris West.
17+
18+
*) Исправление: в обработке целочисленных переполнений.
19+
Спасибо Régis Leroy.
20+
21+
222
Изменения в nginx 1.6.2 16.09.2014
323

424
*) Безопасность: при использовании общего для нескольких блоков server

‎auto/unix

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -489,6 +489,7 @@ ngx_param=NGX_OFF_T_LEN; ngx_value=$ngx_max_len; . auto/types/value
489489
ngx_type="time_t"; . auto/types/sizeof
490490
ngx_param=NGX_TIME_T_SIZE; ngx_value=$ngx_size; . auto/types/value
491491
ngx_param=NGX_TIME_T_LEN; ngx_value=$ngx_max_len; . auto/types/value
492+
ngx_param=NGX_MAX_TIME_T_VALUE; ngx_value=$ngx_max_value; . auto/types/value
492493

493494

494495
# syscalls, libc calls and some features

‎src/core/nginx.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
#define _NGINX_H_INCLUDED_
1010

1111

12-
#define nginx_version 1006002
13-
#define NGINX_VERSION "1.6.2"
12+
#define nginx_version 1006003
13+
#define NGINX_VERSION "1.6.3"
1414
#define NGINX_VER "nginx/" NGINX_VERSION
1515

1616
#define NGINX_VAR "NGINX"

‎src/core/ngx_config.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,11 @@ typedef intptr_t ngx_flag_t;
8585

8686
#if (NGX_PTR_SIZE == 4)
8787
#define NGX_INT_T_LEN NGX_INT32_LEN
88+
#define NGX_MAX_INT_T_VALUE 2147483647
89+
8890
#else
8991
#define NGX_INT_T_LEN NGX_INT64_LEN
92+
#define NGX_MAX_INT_T_VALUE 9223372036854775807
9093
#endif
9194

9295

‎src/core/ngx_hash.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -312,6 +312,8 @@ ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
312312
continue;
313313
}
314314

315+
size = hinit->max_size;
316+
315317
ngx_log_error(NGX_LOG_WARN, hinit->pool->log, 0,
316318
"could not build optimal %s, you should increase "
317319
"either %s_max_size: %i or %s_bucket_size: %i; "

‎src/core/ngx_inet.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,18 @@ ngx_inet_addr(u_char *text, size_t len)
2727

2828
for (p = text; p < text + len; p++) {
2929

30+
if (octet > 255) {
31+
return INADDR_NONE;
32+
}
33+
3034
c = *p;
3135

3236
if (c >= '0' && c <= '9') {
3337
octet = octet * 10 + (c - '0');
3438
continue;
3539
}
3640

37-
if (c == '.' && octet < 256) {
41+
if (c == '.') {
3842
addr = (addr << 8) + octet;
3943
octet = 0;
4044
n++;
@@ -44,7 +48,7 @@ ngx_inet_addr(u_char *text, size_t len)
4448
return INADDR_NONE;
4549
}
4650

47-
if (n == 3 && octet < 256) {
51+
if (n == 3) {
4852
addr = (addr << 8) + octet;
4953
return htonl(addr);
5054
}

‎src/core/ngx_parse.c

Lines changed: 52 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,9 @@
1212
ssize_t
1313
ngx_parse_size(ngx_str_t *line)
1414
{
15-
u_char unit;
16-
size_t len;
17-
ssize_t size;
18-
ngx_int_t scale;
15+
u_char unit;
16+
size_t len;
17+
ssize_t size, scale, max;
1918

2019
len = line->len;
2120
unit = line->data[len - 1];
@@ -24,21 +23,24 @@ ngx_parse_size(ngx_str_t *line)
2423
case 'K':
2524
case 'k':
2625
len--;
26+
max = NGX_MAX_SIZE_T_VALUE / 1024;
2727
scale = 1024;
2828
break;
2929

3030
case 'M':
3131
case 'm':
3232
len--;
33+
max = NGX_MAX_SIZE_T_VALUE / (1024 * 1024);
3334
scale = 1024 * 1024;
3435
break;
3536

3637
default:
38+
max = NGX_MAX_SIZE_T_VALUE;
3739
scale = 1;
3840
}
3941

4042
size = ngx_atosz(line->data, len);
41-
if (size == NGX_ERROR) {
43+
if (size == NGX_ERROR || size > max) {
4244
return NGX_ERROR;
4345
}
4446

@@ -51,10 +53,9 @@ ngx_parse_size(ngx_str_t *line)
5153
off_t
5254
ngx_parse_offset(ngx_str_t *line)
5355
{
54-
u_char unit;
55-
off_t offset;
56-
size_t len;
57-
ngx_int_t scale;
56+
u_char unit;
57+
off_t offset, scale, max;
58+
size_t len;
5859

5960
len = line->len;
6061
unit = line->data[len - 1];
@@ -63,27 +64,31 @@ ngx_parse_offset(ngx_str_t *line)
6364
case 'K':
6465
case 'k':
6566
len--;
67+
max = NGX_MAX_OFF_T_VALUE / 1024;
6668
scale = 1024;
6769
break;
6870

6971
case 'M':
7072
case 'm':
7173
len--;
74+
max = NGX_MAX_OFF_T_VALUE / (1024 * 1024);
7275
scale = 1024 * 1024;
7376
break;
7477

7578
case 'G':
7679
case 'g':
7780
len--;
81+
max = NGX_MAX_OFF_T_VALUE / (1024 * 1024 * 1024);
7882
scale = 1024 * 1024 * 1024;
7983
break;
8084

8185
default:
86+
max = NGX_MAX_OFF_T_VALUE;
8287
scale = 1;
8388
}
8489

8590
offset = ngx_atoof(line->data, len);
86-
if (offset == NGX_ERROR) {
91+
if (offset == NGX_ERROR || offset > max) {
8792
return NGX_ERROR;
8893
}
8994

@@ -98,7 +103,8 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
98103
{
99104
u_char *p, *last;
100105
ngx_int_t value, total, scale;
101-
ngx_uint_t max, valid;
106+
ngx_int_t max, cutoff, cutlim;
107+
ngx_uint_t valid;
102108
enum {
103109
st_start = 0,
104110
st_year,
@@ -115,15 +121,20 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
115121
valid = 0;
116122
value = 0;
117123
total = 0;
124+
cutoff = NGX_MAX_INT_T_VALUE / 10;
125+
cutlim = NGX_MAX_INT_T_VALUE % 10;
118126
step = is_sec ? st_start : st_month;
119-
scale = is_sec ? 1 : 1000;
120127

121128
p = line->data;
122129
last = p + line->len;
123130

124131
while (p < last) {
125132

126133
if (*p >= '0' && *p <= '9') {
134+
if (value >= cutoff && (value > cutoff || *p - '0' > cutlim)) {
135+
return NGX_ERROR;
136+
}
137+
127138
value = value * 10 + (*p++ - '0');
128139
valid = 1;
129140
continue;
@@ -136,7 +147,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
136147
return NGX_ERROR;
137148
}
138149
step = st_year;
139-
max = NGX_MAX_INT32_VALUE / (60 * 60 * 24 * 365);
150+
max = NGX_MAX_INT_T_VALUE / (60 * 60 * 24 * 365);
140151
scale = 60 * 60 * 24 * 365;
141152
break;
142153

@@ -145,7 +156,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
145156
return NGX_ERROR;
146157
}
147158
step = st_month;
148-
max = NGX_MAX_INT32_VALUE / (60 * 60 * 24 * 30);
159+
max = NGX_MAX_INT_T_VALUE / (60 * 60 * 24 * 30);
149160
scale = 60 * 60 * 24 * 30;
150161
break;
151162

@@ -154,7 +165,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
154165
return NGX_ERROR;
155166
}
156167
step = st_week;
157-
max = NGX_MAX_INT32_VALUE / (60 * 60 * 24 * 7);
168+
max = NGX_MAX_INT_T_VALUE / (60 * 60 * 24 * 7);
158169
scale = 60 * 60 * 24 * 7;
159170
break;
160171

@@ -163,7 +174,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
163174
return NGX_ERROR;
164175
}
165176
step = st_day;
166-
max = NGX_MAX_INT32_VALUE / (60 * 60 * 24);
177+
max = NGX_MAX_INT_T_VALUE / (60 * 60 * 24);
167178
scale = 60 * 60 * 24;
168179
break;
169180

@@ -172,7 +183,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
172183
return NGX_ERROR;
173184
}
174185
step = st_hour;
175-
max = NGX_MAX_INT32_VALUE / (60 * 60);
186+
max = NGX_MAX_INT_T_VALUE / (60 * 60);
176187
scale = 60 * 60;
177188
break;
178189

@@ -183,7 +194,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
183194
}
184195
p++;
185196
step = st_msec;
186-
max = NGX_MAX_INT32_VALUE;
197+
max = NGX_MAX_INT_T_VALUE;
187198
scale = 1;
188199
break;
189200
}
@@ -192,7 +203,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
192203
return NGX_ERROR;
193204
}
194205
step = st_min;
195-
max = NGX_MAX_INT32_VALUE / 60;
206+
max = NGX_MAX_INT_T_VALUE / 60;
196207
scale = 60;
197208
break;
198209

@@ -201,7 +212,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
201212
return NGX_ERROR;
202213
}
203214
step = st_sec;
204-
max = NGX_MAX_INT32_VALUE;
215+
max = NGX_MAX_INT_T_VALUE;
205216
scale = 1;
206217
break;
207218

@@ -210,7 +221,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
210221
return NGX_ERROR;
211222
}
212223
step = st_last;
213-
max = NGX_MAX_INT32_VALUE;
224+
max = NGX_MAX_INT_T_VALUE;
214225
scale = 1;
215226
break;
216227

@@ -223,27 +234,40 @@ ngx_parse_time(ngx_str_t *line, ngx_uint_t is_sec)
223234
max /= 1000;
224235
}
225236

226-
if ((ngx_uint_t) value > max) {
237+
if (value > max) {
227238
return NGX_ERROR;
228239
}
229240

230-
total += value * scale;
241+
value *= scale;
231242

232-
if ((ngx_uint_t) total > NGX_MAX_INT32_VALUE) {
243+
if (total > NGX_MAX_INT_T_VALUE - value) {
233244
return NGX_ERROR;
234245
}
235246

247+
total += value;
248+
236249
value = 0;
237-
scale = is_sec ? 1 : 1000;
238250

239251
while (p < last && *p == ' ') {
240252
p++;
241253
}
242254
}
243255

244-
if (valid) {
245-
return total + value * scale;
256+
if (!valid) {
257+
return NGX_ERROR;
258+
}
259+
260+
if (!is_sec) {
261+
if (value > NGX_MAX_INT_T_VALUE / 1000) {
262+
return NGX_ERROR;
263+
}
264+
265+
value *= 1000;
266+
}
267+
268+
if (total > NGX_MAX_INT_T_VALUE - value) {
269+
return NGX_ERROR;
246270
}
247271

248-
return NGX_ERROR;
272+
return total + value;
249273
}

0 commit comments

Comments
 (0)