HTTP parser: fixed memory overflow in the collisions test.
The level hash uses the NULL value as the indicator of a free entry in a bucket. So, inserting a NULL value breaks the hash and can lead to a bucket overflow. In case of the collision counter, the value wasn't initialized, since it's not needed for the purpose of checking collisions. As a result, it might contain any garbage from the stack and in some rare cases the value was NULL. Now the value is initilized.
This commit is contained in:
@@ -1191,6 +1191,7 @@ nxt_http_fields_hash_collisions(nxt_lvlhsh_t *hash, nxt_mp_t *mp,
|
||||
}
|
||||
|
||||
lhq.key_hash = nxt_http_field_hash_end(key) & mask;
|
||||
lhq.value = &items[i];
|
||||
|
||||
if (nxt_lvlhsh_insert(hash, &lhq) == NXT_DECLINED) {
|
||||
colls++;
|
||||
|
||||
Reference in New Issue
Block a user