From 9b76c21b01b75f4b82f1f467ca5397be2c943253 Mon Sep 17 00:00:00 2001 From: Vadim Zhestikov Date: Tue, 11 Aug 2026 11:06:28 -0700 Subject: [PATCH] Memcached: respect the end marker in the maximum supported length The length in the "VALUE" line was accepted up to NGX_MAX_OFF_T_VALUE, while ngx_http_memcached_filter_init() adds the size of the end marker to it. With lengths close to the maximum this overflowed u->length. Now such lengths are rejected, similarly to other invalid lengths. --- src/http/modules/ngx_http_memcached_module.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/http/modules/ngx_http_memcached_module.c b/src/http/modules/ngx_http_memcached_module.c index 11bbd9165..178140d2f 100644 --- a/src/http/modules/ngx_http_memcached_module.c +++ b/src/http/modules/ngx_http_memcached_module.c @@ -413,7 +413,11 @@ found: p = line.data + line.len; u->headers_in.content_length_n = ngx_atoof(start, p - start); - if (u->headers_in.content_length_n == NGX_ERROR) { + + if (u->headers_in.content_length_n == NGX_ERROR + || u->headers_in.content_length_n + > NGX_MAX_OFF_T_VALUE - (off_t) NGX_HTTP_MEMCACHED_END) + { ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "memcached sent invalid length in response \"%V\" " "for key \"%V\"", -- 2.47.3