Skip to content

Commit 523ac10

Browse files
author
Felipe Zimmerle
committed
nginx: copies the req body chain to be processed instead of move
Add a check for the definition MOVE_REQUEST_CHAIN_TO_MODSEC, whenever it is set the chain will be moved into the brigade. If it was not set the chain will be only copied. Moving was causing segfaults on the following regression tests: #15 - SecRequestBodyInMemoryLimit #16 - SecRequestBodyInMemoryLimit (greater) #19 - SecRequestBodyLimitAction ProcessPartial (multipart/greater - chunked) (from: regression/config/10-request-directives.t)
1 parent d294e8f commit 523ac10

File tree

1 file changed

+23
-6
lines changed

1 file changed

+23
-6
lines changed

nginx/modsecurity/ngx_http_modsecurity.c

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -566,7 +566,6 @@ ngx_http_modsecurity_load_request_body(ngx_http_request_t *r)
566566
ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
567567
"ModSec: loading request body.");
568568

569-
570569
ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
571570
"ModSec: loading request body.");
572571

@@ -600,6 +599,10 @@ ngx_http_modsecurity_load_request_body(ngx_http_request_t *r)
600599
}
601600
#endif
602601

602+
return NGX_ERROR;
603+
}
604+
#endif
605+
603606
return NGX_OK;
604607
}
605608
static ngx_inline ngx_int_t
@@ -610,6 +613,7 @@ ngx_http_modsecurity_save_request_body(ngx_http_request_t *r)
610613
apr_off_t content_length;
611614
ngx_buf_t *buf;
612615
#endif
616+
613617
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity);
614618

615619
#ifdef MOVE_REQUEST_CHAIN_TO_MODSEC
@@ -652,10 +656,15 @@ ngx_http_modsecurity_save_request_body(ngx_http_request_t *r)
652656

653657
}
654658

655-
656659
r->headers_in.content_length_n = content_length;
657660

658-
ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "ModSec: Content length: %O, Content length n: %O", content_length, r->headers_in.content_length_n);
661+
ngx_log_debug(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
662+
"ModSec: Content length: %O, Content length n: %O", content_length,
663+
r->headers_in.content_length_n);
664+
#else
665+
apr_brigade_cleanup(ctx->brigade);
666+
#endif
667+
659668
return NGX_OK;
660669
}
661670

@@ -1238,10 +1247,18 @@ ngx_http_modsecurity_handler(ngx_http_request_t *r) {
12381247

12391248
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
12401249
"ModSec: request is ready to be processed.");
1241-
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
1242-
"ModSec: chuncked? %d", r->chunked);
1243-
ngx_http_modsecurity_process_request(r);
1250+
rc = ngx_http_modsecurity_process_request(r);
12441251
ctx->request_processed = 1;
1252+
1253+
if (rc == NGX_ERROR || rc >= NGX_HTTP_SPECIAL_RESPONSE) {
1254+
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
1255+
"ModSec: returning a special response after process " \
1256+
"a request: %d", rc);
1257+
1258+
return rc;
1259+
}
1260+
1261+
12451262
}
12461263

12471264
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,

0 commit comments

Comments
 (0)