Blame SOURCES/nginx-1.10.2-CVE-2019-9516.patch
|
|
65cc5e |
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
|
|
|
65cc5e |
index 90b10a8..b2adcb9 100644
|
|
|
65cc5e |
--- a/src/http/v2/ngx_http_v2.c
|
|
|
65cc5e |
+++ b/src/http/v2/ngx_http_v2.c
|
|
|
65cc5e |
@@ -1516,6 +1516,14 @@ ngx_http_v2_state_process_header(ngx_http_v2_connection_t *h2c, u_char *pos,
|
|
|
65cc5e |
header->name.len = h2c->state.field_end - h2c->state.field_start;
|
|
|
65cc5e |
header->name.data = h2c->state.field_start;
|
|
|
65cc5e |
|
|
|
65cc5e |
+ if (header->name.len == 0) {
|
|
|
65cc5e |
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
|
|
|
65cc5e |
+ "client sent zero header name length");
|
|
|
65cc5e |
+
|
|
|
65cc5e |
+ return ngx_http_v2_connection_error(h2c,
|
|
|
65cc5e |
+ NGX_HTTP_V2_PROTOCOL_ERROR);
|
|
|
65cc5e |
+ }
|
|
|
65cc5e |
+
|
|
|
65cc5e |
return ngx_http_v2_state_field_len(h2c, pos, end);
|
|
|
65cc5e |
}
|
|
|
65cc5e |
|
|
|
65cc5e |
@@ -2969,10 +2977,6 @@ ngx_http_v2_validate_header(ngx_http_request_t *r, ngx_http_v2_header_t *header)
|
|
|
65cc5e |
ngx_uint_t i;
|
|
|
65cc5e |
ngx_http_core_srv_conf_t *cscf;
|
|
|
65cc5e |
|
|
|
65cc5e |
- if (header->name.len == 0) {
|
|
|
65cc5e |
- return NGX_ERROR;
|
|
|
65cc5e |
- }
|
|
|
65cc5e |
-
|
|
|
65cc5e |
r->invalid_header = 0;
|
|
|
65cc5e |
|
|
|
65cc5e |
cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
|