From: Vadim Zhestikov <v.zhestikov@f5.com>
Date: Tue, 11 Aug 2026 21:06:19 +0000 (-0700)
Subject: Slice filter: overflow protection in slice range requests
X-Git-Tag: release-1.30.6~11
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=1b2ea0fb055458f79cd78f9f55de38b606033169;p=nginx.git

Slice filter: overflow protection in slice range requests

When the byte range is passed in the client Range header, the range
start is accepted up to NGX_MAX_OFF_T_VALUE, while
ngx_http_slice_range_variable() adds the slice size to it when
formatting the slice end.  With start values close to the maximum
this overflowed.

Now such range starts are ignored, similarly to other ranges not
handled by ngx_http_slice_get_start().
---

diff --git a/src/http/modules/ngx_http_slice_filter_module.c b/src/http/modules/ngx_http_slice_filter_module.c
index 67dc14c82..97f808ee5 100644
--- a/src/http/modules/ngx_http_slice_filter_module.c
+++ b/src/http/modules/ngx_http_slice_filter_module.c
@@ -428,6 +428,10 @@ ngx_http_slice_range_variable(ngx_http_request_t *r,
 
         ctx->start = slcf->size * (ngx_http_slice_get_start(r) / slcf->size);
 
+        if (ctx->start > NGX_MAX_OFF_T_VALUE - (off_t) slcf->size) {
+            ctx->start = 0;
+        }
+
         ctx->range.data = p;
         ctx->range.len = ngx_sprintf(p, "bytes=%O-%O", ctx->start,
                                      ctx->start + (off_t) slcf->size - 1)