Map: fixed regex pattern lifetime

The regex pattern was referenced from the temporary pool used for
map block parsing, which is destroyed once the block is parsed.  The
pattern is later used for logging if regex matching fails, e.g., due
to PCRE2 match limit, JIT stack limit, or invalid UTF-8 with (*UTF),
resulting in released memory being logged.

The fix is to copy the pattern into the configuration pool.

diff --git a/src/http/modules/ngx_http_map_module.c b/src/http/modules/ngx_http_map_module.c
index 2fc9be90b7ae98c8299831d866ea525db814dc21..edcda129263cae5e30acc7eed43d8ecaba54d155 100644 (file)
--- a/src/http/modules/ngx_http_map_module.c
+++ b/src/http/modules/ngx_http_map_module.c
@@ -547,7 +547,14 @@ found:
             rc.options = NGX_REGEX_CASELESS;
         }
 
-        rc.pattern = value[0];
+        rc.pattern.len = value[0].len;
+        rc.pattern.data = ngx_pnalloc(ctx->keys.pool, value[0].len + 1);
+        if (rc.pattern.data == NULL) {
+            return NGX_CONF_ERROR;
+        }
+
+        ngx_memcpy(rc.pattern.data, value[0].data, value[0].len + 1);
+
         rc.err.len = NGX_MAX_CONF_ERRSTR;
         rc.err.data = errstr;
 

diff --git a/src/stream/ngx_stream_map_module.c b/src/stream/ngx_stream_map_module.c
index ef06b2de872810fb04bb1e700fea1aeb8c4cb07e..65902973ede381c09f91f1e8f22205f9869793a0 100644 (file)
--- a/src/stream/ngx_stream_map_module.c
+++ b/src/stream/ngx_stream_map_module.c
@@ -546,7 +546,14 @@ found:
             rc.options = NGX_REGEX_CASELESS;
         }
 
-        rc.pattern = value[0];
+        rc.pattern.len = value[0].len;
+        rc.pattern.data = ngx_pnalloc(ctx->keys.pool, value[0].len + 1);
+        if (rc.pattern.data == NULL) {
+            return NGX_CONF_ERROR;
+        }
+
+        ngx_memcpy(rc.pattern.data, value[0].data, value[0].len + 1);
+
         rc.err.len = NGX_MAX_CONF_ERRSTR;
         rc.err.data = errstr;