186526/openresty
1
0
Fork 0
mirror of https://github.com/openresty/openresty.git synced 2024-10-13 00:29:41 +00:00
Code Issues Projects Releases Wiki Activity

bugfix: applied nginx's official security fix for an issue in the range filter (CVE-2017-7529).

Browse Source
This commit is contained in:
Yichun Zhang (agentzh)
2017-07-11 10:31:25 -07:00
parent 11284ae527
commit 19c6e1fb5c
2 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
patches/patch.2017.ranges.txt Normal file
View File

@ -0,0 +1,14 @@
diffsrc/http/modules/ngx_http_range_filter_module.c b/src/http/modules/ngx_http_range_filter_module.c
--- src/http/modules/ngx_http_range_filter_module.c
+++ src/http/modules/ngx_http_range_filter_module.c
@@ -377,6 +377,10 @@ ngx_http_range_parse(ngx_http_request_t
range->start = start;
range->end = end;
+ if (size > NGX_MAX_OFF_T_VALUE - (end - start)) {
+ return NGX_HTTP_RANGE_NOT_SATISFIABLE;
+ }
+
size += end - start;
if (ranges-- == 0) {