Modsecurity V3 causes nginx to core dump on a system with limited ram when uploading a large file

[AndrewFromMelbourne]

We are using Modsecurity V3 and nginx on a system with limited ram/swap space. We accepted a file upload that has a reasonable size.

nginx log

2017/07/30 22:07:05 [alert] 11633#11633: worker process 11634 exited on signal 6 (core dumped)
2017/07/30 22:07:05 [warn] 11636#11636: *46 a client request body is buffered to a temporary file /var/lib/nginx/body/0029830514, client: 192.168.0.4, server: localhost, request: “POST /upload.html HTTP/1.1”, host: “192.168.0.5", referrer: “http://192.168.0.5/upgrade.html”
terminate called after throwing an instance of ‘std::bad_alloc’
 what():  std::bad_alloc

The function Transaction::requestBodyFromFile() uses std::string::reserve() to allocate a buffer the same size as the file being read. On systems that have limited memory, this results in the std::bad_alloc exception being thrown, which causes (in our system) nginx to core dump.

[zimmerle]

Hi @AndrewFromMelbourne,

Now we have a graceful error if there is no memory. Should not segfault anymore. Thanks ;)