Fixed uninitialized memory read caused by stale regex captures.

When ngx_http_regex_exec() reallocates r->captures array, it doesn't update
r->ncaptures value, if regex didn't match. So the next use of unnamed regex
capture triggers uninitialized read and potential buffer overrun.

This config demonstrates the issue:
    map test $my_map {
        volatile;

        ~mismatch(.*) 1; # reallocates r->captures in subrequests

        default "";
    }

    server {
        location ~(.*) { # sets r->ncaptures
            slice 50;

            # $1 will read from uninitialized memory in slice subrequests
            proxy_set_header Test $my_map$1;

            proxy_set_header Range $slice_range;
            proxy_pass http://backend;
        }
    }

The issue was introduced by 746fba0d79c6.

diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
index 191bc73c7f9c7e0856aa417690c7494fd76c8259..4e63dc7e030815a56b6181d2b2069604cd7d82a3 100644 (file)
--- a/src/http/ngx_http_variables.c
+++ b/src/http/ngx_http_variables.c
@@ -2685,6 +2685,7 @@ ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
 
         if (r->captures == NULL || r->realloc_captures) {
             r->realloc_captures = 0;
+            r->ncaptures = 0;
 
             r->captures = ngx_palloc(r->pool, len * sizeof(int));
             if (r->captures == NULL) {