Nginx 1.1.18 Crash (off by one bug) -> Windows

[Benjamin Johnson]

Windows 7
Repeatable
Many Nginx versions, I reproduced it with Nginx 1.0.X (I believe several versions had this issue including 1.0.14, although I didn't do analysis), and from compiled source 1.1.18.

In src/os/win32/ngx_shmem.c, ngx_alloc does not account for the %Z (terminating \0). I was getting relatively frequent crashes on simple requests.

Index: src/os/win32/ngx_shmem.c
===================================================================
--- src/os/win32/ngx_shmem.c (revision 4568)
+++ src/os/win32/ngx_shmem.c (working copy)
@@ -15,7 +15,7 @@

u_char *name;
uint64_t size;

• name = ngx_alloc(shm->name.len + 2 + sizeof(NGX_INT32_LEN), shm->log);

+ name = ngx_alloc(shm->name.len + 2 + sizeof(NGX_INT32_LEN) + 1, shm->log);

if (name == NULL) {

return NGX_ERROR;

}

[Benjamin Johnson]

patch

[Benjamin Johnson]

Changed to be more explicit for future developers:

Index: src/os/win32/ngx_shmem.c
===================================================================
--- src/os/win32/ngx_shmem.c (revision 4568)
+++ src/os/win32/ngx_shmem.c (working copy)
@@ -15,7 +15,7 @@

u_char *name;
uint64_t size;

• name = ngx_alloc(shm->name.len + 2 + sizeof(NGX_INT32_LEN), shm->log);

+ name = ngx_alloc(shm->name.len + 2 + sizeof(NGX_INT32_LEN) + sizeof('\0'), shm->log);

if (name == NULL) {

return NGX_ERROR;

}

[Vincent Lee]

what you found is as same as #134.but your fixing is not very good...

[Benjamin Johnson]

Replying to 永平 李:

what you found is as same as #134.but your fixing is not very good...

Well your comment could be nicer, but thanks for pointing out a better fix.

[Maxim Dounin]

Duplicate of #134.