Skip to content

Missing buffer spill check. #20

Description

@jbmln

ngx_link_func_module.c:1574

                if (b->in_file) {
                    ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "insufficient client_body_buffer_size");
                    goto SKIP_REQUEST_BODY;
                }

ngx_link_func_module.c:1597-1604

} else {
            b = r->request_body->bufs->buf;
            if ( !b->pos || (len = ngx_buf_size(b)) == 0) {
                goto SKIP_REQUEST_BODY;
            }
            new_ctx->req_body = b->pos;
            new_ctx->req_body_len = len;
        }

The else branch is missing the "has the buffer spilled to a temp file" branch. The consequences of this might be marginal but wouldn't it be better to hoist the check out of the branch? this is currently only incidentally safe (I think) for some code and if link_function is being used for any kind of firewall code might fail open.

BW.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions