mirror of
https://github.com/nginx/nginx.git
synced 2026-06-10 17:31:53 -04:00
ca4f92a274
When the rewrite replacement string had no variables, but had
overlapping captures, the length of the allocated buffer could be
smaller than the replacement string. This could happen either
when the "redirect" parameter is specified, or when arguments are
present in the replacement string.
The following configurations resulted in heap buffer overflow when
using URI "/++++++++++++++++++++++++++++++":
location / {
rewrite ^/((.*))$ http://127.0.0.1:8080/$1$2 redirect;
return 200 foo;
}
location / {
rewrite ^/((.*))$ http://127.0.0.1:8080/?$1$2;
return 200 foo;
}
Reported by Mufeed VH of Winfunc Research.
|
||
|---|---|---|
| .. | ||
| core | ||
| event | ||
| http | ||
| misc | ||
| os | ||
| stream | ||