Skip to content

Commit 95b1817

Browse files
author
Felipe Zimmerle
committed
nginx: copies the req body chain to be processed instead of move
Add a check for the definition MOVE_REQUEST_CHAIN_TO_MODSEC, whenever it is set the chain will be moved into the brigade. If it was not set the chain will be only copied. Moving was causing segfaults on the following regression tests: #15 - SecRequestBodyInMemoryLimit #16 - SecRequestBodyInMemoryLimit (greater) #19 - SecRequestBodyLimitAction ProcessPartial (multipart/greater - chunked) (from: regression/config/10-request-directives.t)
1 parent b3ba9c4 commit 95b1817

File tree

1 file changed

+19
-6
lines changed

1 file changed

+19
-6
lines changed

nginx/modsecurity/ngx_http_modsecurity.c

+19-6
Original file line numberDiff line numberDiff line change
@@ -566,7 +566,6 @@ ngx_http_modsecurity_load_request_body(ngx_http_request_t *r)
566566
ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
567567
"ModSec: loading request body.");
568568

569-
570569
ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
571570
"ModSec: loading request body.");
572571

@@ -610,6 +609,7 @@ ngx_http_modsecurity_save_request_body(ngx_http_request_t *r)
610609
apr_off_t content_length;
611610
ngx_buf_t *buf;
612611
#endif
612+
613613
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity);
614614

615615
#ifdef MOVE_REQUEST_CHAIN_TO_MODSEC
@@ -652,10 +652,15 @@ ngx_http_modsecurity_save_request_body(ngx_http_request_t *r)
652652

653653
}
654654

655-
656655
r->headers_in.content_length_n = content_length;
657656

658-
ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "ModSec: Content length: %O, Content length n: %O", content_length, r->headers_in.content_length_n);
657+
ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
658+
"ModSec: Content length: %O, Content length n: %O", content_length,
659+
r->headers_in.content_length_n);
660+
#else
661+
apr_brigade_cleanup(ctx->brigade);
662+
#endif
663+
659664
return NGX_OK;
660665
}
661666

@@ -1238,10 +1243,18 @@ ngx_http_modsecurity_handler(ngx_http_request_t *r) {
12381243

12391244
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
12401245
"ModSec: request is ready to be processed.");
1241-
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
1242-
"ModSec: chuncked? %d", r->chunked);
1243-
ngx_http_modsecurity_process_request(r);
1246+
rc = ngx_http_modsecurity_process_request(r);
12441247
ctx->request_processed = 1;
1248+
1249+
if (rc == NGX_ERROR || rc >= NGX_HTTP_SPECIAL_RESPONSE) {
1250+
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
1251+
"ModSec: returning a special response after process " \
1252+
"a request: %d", rc);
1253+
1254+
return rc;
1255+
}
1256+
1257+
12451258
}
12461259

12471260
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,

0 commit comments

Comments
 (0)