From b99f804ad38a60ceb07bc429598d5b2c4e70e336 Mon Sep 17 00:00:00 2001
From: Pavel Pautov <p.pautov@f5.com>
Date: Fri, 15 May 2026 00:48:50 -0700
Subject: [PATCH] Fixed uninitialized memory read caused by stale regex
 captures.

When ngx_http_regex_exec() reallocates r->captures array, it doesn't update
r->ncaptures value, if regex didn't match. So the next use of unnamed regex
capture triggers uninitialized read and potential buffer overrun.

This config demonstrates the issue:
    map test $my_map {
        volatile;

        ~mismatch(.*) 1; # reallocates r->captures in subrequests

        default "";
    }

    server {
        location ~(.*) { # sets r->ncaptures
            slice 50;

            # $1 will read from uninitialized memory in slice subrequests
            proxy_set_header Test $my_map$1;

            proxy_set_header Range $slice_range;
            proxy_pass http://backend;
        }
    }

The issue was introduced by 746fba0d79c6.
---
 src/http/ngx_http_variables.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
index 37cd0d287..ab234b974 100644
--- a/src/http/ngx_http_variables.c
+++ b/src/http/ngx_http_variables.c
@@ -2681,6 +2681,7 @@ ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
 
         if (r->captures == NULL || r->realloc_captures) {
             r->realloc_captures = 0;
+            r->ncaptures = 0;
 
             r->captures = ngx_palloc(r->pool, len * sizeof(int));
             if (r->captures == NULL) {
-- 
2.47.3