I'm submitting this patch on behalf of Ruslan Ermilov (ru@nginx.com),
who is an nginx developer. You can reach out to him directly in case
of any questions. Also, please note, that there are two possible
approaches to fixing the problem. This one is more straightforward
while the second one (next pull request) is more efficient.
Below is the author's original commit log:
ngx_http_cookie_flag_filter_handler() allocated not enough memory
for "cookie_name". The strcat() call would write '\0' outside the
allocated buffer. The current code also incorrectly matches any
cookie whose name ends in "foo" if "set_cookie_flag foo ..." is
specified. Both bugs fixed by rewriting the code that matches
cookies by name.
ngx_http_cookie_flag_filter_append() allocated not enough memory
when editing cookie values. Generally, strings in nginx are not
NUL-terminated, but there are some exceptions, including the
values of request/response headers. While that assumption allows
searching for substrings with ngx_strcasestrn(), the edited values
were not NUL-terminated. This is fixed by allocating enough memory
to have NUL-terminated strings.
I'm submitting this patch on behalf of Ruslan Ermilov (ru@nginx.com), who is an nginx developer. You can reach out to him directly in case of any questions. Also, please note, that there are two possible approaches to fixing the problem. This one is more straightforward while the second one (next pull request) is more efficient. Below is the author's original commit log:
ngx_http_cookie_flag_filter_handler() allocated not enough memory for "cookie_name". The strcat() call would write '\0' outside the allocated buffer. The current code also incorrectly matches any cookie whose name ends in "foo" if "set_cookie_flag foo ..." is specified. Both bugs fixed by rewriting the code that matches cookies by name.
ngx_http_cookie_flag_filter_append() allocated not enough memory when editing cookie values. Generally, strings in nginx are not NUL-terminated, but there are some exceptions, including the values of request/response headers. While that assumption allows searching for substrings with ngx_strcasestrn(), the edited values were not NUL-terminated. This is fixed by allocating enough memory to have NUL-terminated strings.