From: Y.Horie <u5.horie@gmail.com>
Date: Tue, 27 Oct 2026 22:25:20 +0000 (+0900)
Subject: GeoIP: rejected out-of-range coordinates from MMDB lookups
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=45ae79aa6aa1f2b322235f12e3c79111b5a7041f;p=nginx.git

GeoIP: rejected out-of-range coordinates from MMDB lookups

The $geoip_latitude and $geoip_longitude values are formatted with
ngx_sprintf(buf, "%.4f", value) into a buffer sized for a coordinate,
but the DOUBLE/FLOAT value is taken from the database with no range
check.  A crafted or corrupted MMDB can store a huge magnitude (e.g.
1e30 or an infinity), and ngx_sprintf, which is unbounded, then writes
past the buffer in the request or connection pool.

Coordinates outside [-180, 180] are now rejected, so the variables
report "not found" as they do for a missing entry.  The comparison also
rejects a NaN.

Closes: https://github.com/nginx/nginx/issues/1907
---

diff --git a/src/http/modules/ngx_http_geoip_module.c b/src/http/modules/ngx_http_geoip_module.c
index 05f3d8aa3..cee2c4957 100644
--- a/src/http/modules/ngx_http_geoip_module.c
+++ b/src/http/modules/ngx_http_geoip_module.c
@@ -35,6 +35,8 @@
 #define NGX_GEOIP_CITY_DMA_CODE        10
 #define NGX_GEOIP_CITY_AREA_CODE       11
 
+#define NGX_GEOIP_MAX_COORD            180
+
 
 typedef struct {
 #if (NGX_HAVE_GEOIP)
@@ -1193,15 +1195,23 @@ ngx_http_geoip_float(MMDB_entry_s *entry, const char **path, double *value)
 
     case MMDB_DATA_TYPE_DOUBLE:
         *value = entry_data.double_value;
-        return NGX_OK;
+        break;
 
     case MMDB_DATA_TYPE_FLOAT:
         *value = entry_data.float_value;
-        return NGX_OK;
+        break;
 
     default:
         return NGX_DECLINED;
     }
+
+    /* the range of a coordinate in degrees; NaN fails the comparison */
+
+    if (!(*value >= -NGX_GEOIP_MAX_COORD && *value <= NGX_GEOIP_MAX_COORD)) {
+        return NGX_DECLINED;
+    }
+
+    return NGX_OK;
 }
 
 
diff --git a/src/stream/ngx_stream_geoip_module.c b/src/stream/ngx_stream_geoip_module.c
index 67896837d..812200394 100644
--- a/src/stream/ngx_stream_geoip_module.c
+++ b/src/stream/ngx_stream_geoip_module.c
@@ -35,6 +35,8 @@
 #define NGX_GEOIP_CITY_DMA_CODE        10
 #define NGX_GEOIP_CITY_AREA_CODE       11
 
+#define NGX_GEOIP_MAX_COORD            180
+
 
 typedef struct {
 #if (NGX_HAVE_GEOIP)
@@ -1155,15 +1157,23 @@ ngx_stream_geoip_float(MMDB_entry_s *entry, const char **path, double *value)
 
     case MMDB_DATA_TYPE_DOUBLE:
         *value = entry_data.double_value;
-        return NGX_OK;
+        break;
 
     case MMDB_DATA_TYPE_FLOAT:
         *value = entry_data.float_value;
-        return NGX_OK;
+        break;
 
     default:
         return NGX_DECLINED;
     }
+
+    /* the range of a coordinate in degrees; NaN fails the comparison */
+
+    if (!(*value >= -NGX_GEOIP_MAX_COORD && *value <= NGX_GEOIP_MAX_COORD)) {
+        return NGX_DECLINED;
+    }
+
+    return NGX_OK;
 }