Klaus Demo nginx / f09eae2
Fixed incorrect length handling in ngx_utf8_length(). Previously, ngx_utf8_decode() was called from ngx_utf8_length() with incorrect length, potentially resulting in out-of-bounds read when handling invalid UTF-8 strings. In practice out-of-bounds reads are not possible though, as autoindex, the only user of ngx_utf8_length(), provides null-terminated strings, and ngx_utf8_decode() anyway returns an errors when it sees a null in the middle of an UTF-8 sequence. Reported by Yunbin Liu. Maxim Dounin 3 years ago
1 changed file(s) with 1 addition(s) and 1 deletion(s). Raw diff Collapse all Expand all
13801380 continue;
13811381 }
13821382
1383 if (ngx_utf8_decode(&p, n) > 0x10ffff) {
1383 if (ngx_utf8_decode(&p, last - p) > 0x10ffff) {
13841384 /* invalid UTF-8 */
13851385 return n;
13861386 }