HTTP parser: fixed memory overflow in the collisions test.
The level hash uses the NULL value as the indicator of a free entry in a bucket. So, inserting a NULL value breaks the hash and can lead to a bucket overflow. In case of the collision counter, the value wasn't initialized, since it's not needed for the purpose of checking collisions. As a result, it might contain any garbage from the stack and in some rare cases the value was NULL. Now the value is initilized.
This commit is contained in:
@@ -1191,6 +1191,7 @@ nxt_http_fields_hash_collisions(nxt_lvlhsh_t *hash, nxt_mp_t *mp,
|
|||||||
}
|
}
|
||||||
|
|
||||||
lhq.key_hash = nxt_http_field_hash_end(key) & mask;
|
lhq.key_hash = nxt_http_field_hash_end(key) & mask;
|
||||||
|
lhq.value = &items[i];
|
||||||
|
|
||||||
if (nxt_lvlhsh_insert(hash, &lhq) == NXT_DECLINED) {
|
if (nxt_lvlhsh_insert(hash, &lhq) == NXT_DECLINED) {
|
||||||
colls++;
|
colls++;
|
||||||
|
|||||||
Reference in New Issue
Block a user