Closed i-rinat closed 7 years ago
To reproduce crash, start nginx with configuration:
worker_processes 1;
master_process off;
daemon off;
events { worker_connections 1024; }
http {
server {
listen 8080;
auth_ldap Hello;
location / { root html; index index.html index.htm; }
}
}
and send request "GET / HTTP/1.0\nAuthorization: Basic YTph\n\n"
.
If for some reason administrator adds
auth_ldap
directive, but forgets to addauth_ldap_servers
, servers array for the location remains uninitialized. And when request withAuthorization
headers field arrives,NULL
gets dereferenced.This patch checks that array is initialized in
ngx_http_auth_ldap_handler()
, before other functions are called.