From: Roman Arutyunyan <arut@nginx.com>
Date: Fri, 6 Nov 2026 11:47:47 +0000 (+0400)
Subject: Map: fixed regex pattern lifetime
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=d17f1d249d386de1282222172f526973fcd8a702;p=nginx.git

Map: fixed regex pattern lifetime

The regex pattern was referenced from the temporary pool used for
map block parsing, which is destroyed once the block is parsed.  The
pattern is later used for logging if regex matching fails, e.g., due
to PCRE2 match limit, JIT stack limit, or invalid UTF-8 with (*UTF),
resulting in released memory being logged.

The fix is to copy the pattern into the configuration pool.
---

diff --git a/src/http/modules/ngx_http_map_module.c b/src/http/modules/ngx_http_map_module.c
index 2fc9be90b..edcda1292 100644
--- a/src/http/modules/ngx_http_map_module.c
+++ b/src/http/modules/ngx_http_map_module.c
@@ -547,7 +547,14 @@ found:
             rc.options = NGX_REGEX_CASELESS;
         }
 
-        rc.pattern = value[0];
+        rc.pattern.len = value[0].len;
+        rc.pattern.data = ngx_pnalloc(ctx->keys.pool, value[0].len + 1);
+        if (rc.pattern.data == NULL) {
+            return NGX_CONF_ERROR;
+        }
+
+        ngx_memcpy(rc.pattern.data, value[0].data, value[0].len + 1);
+
         rc.err.len = NGX_MAX_CONF_ERRSTR;
         rc.err.data = errstr;
 
diff --git a/src/stream/ngx_stream_map_module.c b/src/stream/ngx_stream_map_module.c
index ef06b2de8..65902973e 100644
--- a/src/stream/ngx_stream_map_module.c
+++ b/src/stream/ngx_stream_map_module.c
@@ -546,7 +546,14 @@ found:
             rc.options = NGX_REGEX_CASELESS;
         }
 
-        rc.pattern = value[0];
+        rc.pattern.len = value[0].len;
+        rc.pattern.data = ngx_pnalloc(ctx->keys.pool, value[0].len + 1);
+        if (rc.pattern.data == NULL) {
+            return NGX_CONF_ERROR;
+        }
+
+        ngx_memcpy(rc.pattern.data, value[0].data, value[0].len + 1);
+
         rc.err.len = NGX_MAX_CONF_ERRSTR;
         rc.err.data = errstr;