From: Pavel Pautov <p.pautov@f5.com>
Date: Fri, 15 May 2026 07:48:50 +0000 (-0700)
Subject: Fixed uninitialized memory read caused by stale regex captures.
X-Git-Tag: release-1.31.3~2
X-Git-Url: http://git.kaiwu.me/http/$%7BGITURL%7D/doc/static/gitweb.js?a=commitdiff_plain;h=0cca8e055a2d909f1a00c2071665b502ec2fe94c;p=nginx.git

Fixed uninitialized memory read caused by stale regex captures.

When ngx_http_regex_exec() reallocates r->captures array, it doesn't update
r->ncaptures value, if regex didn't match. So the next use of unnamed regex
capture triggers uninitialized read and potential buffer overrun.

This config demonstrates the issue:
    map test $my_map {
        volatile;

        ~mismatch(.*) 1; # reallocates r->captures in subrequests

        default "";
    }

    server {
        location ~(.*) { # sets r->ncaptures
            slice 50;

            # $1 will read from uninitialized memory in slice subrequests
            proxy_set_header Test $my_map$1;

            proxy_set_header Range $slice_range;
            proxy_pass http://backend;
        }
    }

The issue was introduced by 746fba0d79c6.
---

diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
index 191bc73c7..4e63dc7e0 100644
--- a/src/http/ngx_http_variables.c
+++ b/src/http/ngx_http_variables.c
@@ -2685,6 +2685,7 @@ ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
 
         if (r->captures == NULL || r->realloc_captures) {
             r->realloc_captures = 0;
+            r->ncaptures = 0;
 
             r->captures = ngx_palloc(r->pool, len * sizeof(int));
             if (r->captures == NULL) {