Upstream: fixed u->headers_in.headers allocation error handling.

Previously, an allocation error resulted in uninitialized memory access
when evaluating $upstream_http_ variables.

On a related note, see r->headers_out.headers cleanup work in 0cdee26605f3.
This commit is contained in:
Sergey Kandaurov 2017-05-18 14:17:00 +03:00
parent 84fdff7930
commit 9359155b2f
4 changed files with 6 additions and 0 deletions

View File

@ -1878,6 +1878,7 @@ ngx_http_fastcgi_process_header(ngx_http_request_t *r)
p = ngx_pnalloc(r->pool, size);
if (p == NULL) {
h->hash = 0;
return NGX_ERROR;
}
@ -1900,6 +1901,7 @@ ngx_http_fastcgi_process_header(ngx_http_request_t *r)
ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
"invalid header after joining "
"FastCGI records");
h->hash = 0;
return NGX_ERROR;
}
@ -1925,6 +1927,7 @@ ngx_http_fastcgi_process_header(ngx_http_request_t *r)
h->key.len + 1 + h->value.len + 1
+ h->key.len);
if (h->key.data == NULL) {
h->hash = 0;
return NGX_ERROR;
}

View File

@ -1798,6 +1798,7 @@ ngx_http_proxy_process_header(ngx_http_request_t *r)
h->key.data = ngx_pnalloc(r->pool,
h->key.len + 1 + h->value.len + 1 + h->key.len);
if (h->key.data == NULL) {
h->hash = 0;
return NGX_ERROR;
}

View File

@ -1040,6 +1040,7 @@ ngx_http_scgi_process_header(ngx_http_request_t *r)
h->key.len + 1 + h->value.len + 1
+ h->key.len);
if (h->key.data == NULL) {
h->hash = 0;
return NGX_ERROR;
}

View File

@ -1244,6 +1244,7 @@ ngx_http_uwsgi_process_header(ngx_http_request_t *r)
h->key.len + 1 + h->value.len + 1
+ h->key.len);
if (h->key.data == NULL) {
h->hash = 0;
return NGX_ERROR;
}