From: Vadim Zhestikov <v.zhestikov@f5.com>
Date: Tue, 11 Aug 2026 18:06:28 +0000 (-0700)
Subject: Memcached: respect the end marker in the maximum supported length
X-Git-Tag: release-1.30.6~13
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=f14320c4018821cd1dafc4686a720cc0a0c138f3;p=nginx.git

Memcached: respect the end marker in the maximum supported length

The length in the "VALUE" line was accepted up to NGX_MAX_OFF_T_VALUE,
while ngx_http_memcached_filter_init() adds the size of the end marker
to it.  With lengths close to the maximum this overflowed u->length.

Now such lengths are rejected, similarly to other invalid lengths.
---

diff --git a/src/http/modules/ngx_http_memcached_module.c b/src/http/modules/ngx_http_memcached_module.c
index 11bbd9165..178140d2f 100644
--- a/src/http/modules/ngx_http_memcached_module.c
+++ b/src/http/modules/ngx_http_memcached_module.c
@@ -413,7 +413,11 @@ found:
         p = line.data + line.len;
 
         u->headers_in.content_length_n = ngx_atoof(start, p - start);
-        if (u->headers_in.content_length_n == NGX_ERROR) {
+
+        if (u->headers_in.content_length_n == NGX_ERROR
+            || u->headers_in.content_length_n
+               > NGX_MAX_OFF_T_VALUE - (off_t) NGX_HTTP_MEMCACHED_END)
+        {
             ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                           "memcached sent invalid length in response \"%V\" "
                           "for key \"%V\"",