From d115763f8e4ac14969ddc18d83ba215502c4f628 Mon Sep 17 00:00:00 2001 From: Sourav Bhowmik Date: Thu, 13 Aug 2026 05:40:29 -0700 Subject: [PATCH] Rejected zero size in buffer-size directives When set to zero, this resulted in a buffer with no room to read into. As there is no meaningful interpretation of a zero-sized buffer, such configuration is explicitly rejected. Reported by kh-lee --- src/core/ngx_conf_file.c | 16 ++++++++++++++++ src/core/ngx_conf_file.h | 4 ++++ src/http/modules/ngx_http_fastcgi_module.c | 2 +- src/http/modules/ngx_http_grpc_module.c | 2 +- src/http/modules/ngx_http_memcached_module.c | 2 +- src/http/modules/ngx_http_mp4_module.c | 4 ++-- src/http/modules/ngx_http_proxy_module.c | 2 +- src/http/modules/ngx_http_scgi_module.c | 2 +- src/http/modules/ngx_http_ssl_module.c | 2 +- src/http/modules/ngx_http_tunnel_module.c | 2 +- src/http/modules/ngx_http_uwsgi_module.c | 2 +- src/http/ngx_http_core_module.c | 6 +++--- src/http/v3/ngx_http_v3_module.c | 2 +- src/mail/ngx_mail_proxy_module.c | 2 +- src/stream/ngx_stream_core_module.c | 2 +- src/stream/ngx_stream_proxy_module.c | 2 +- 16 files changed, 37 insertions(+), 17 deletions(-) diff --git a/src/core/ngx_conf_file.c b/src/core/ngx_conf_file.c index 5aee80146..bc902d273 100644 --- a/src/core/ngx_conf_file.c +++ b/src/core/ngx_conf_file.c @@ -59,6 +59,9 @@ static ngx_uint_t argument_number[] = { }; +ngx_conf_post_t ngx_conf_size_nonzero_post = { ngx_conf_check_size_nonzero }; + + char * ngx_conf_param(ngx_conf_t *cf) { @@ -1487,3 +1490,16 @@ ngx_conf_check_num_bounds(ngx_conf_t *cf, void *post, void *data) return NGX_CONF_ERROR; } + + +char * +ngx_conf_check_size_nonzero(ngx_conf_t *cf, void *post, void *data) +{ + size_t *sp = data; + + if (*sp == 0) { + return "value must be nonzero"; + } + + return NGX_CONF_OK; +} diff --git a/src/core/ngx_conf_file.h b/src/core/ngx_conf_file.h index ed2d2ba9d..b507fbb28 100644 --- a/src/core/ngx_conf_file.h +++ b/src/core/ngx_conf_file.h @@ -171,6 +171,10 @@ typedef struct { char * ngx_conf_deprecated(ngx_conf_t *cf, void *post, void *data); char *ngx_conf_check_num_bounds(ngx_conf_t *cf, void *post, void *data); +char *ngx_conf_check_size_nonzero(ngx_conf_t *cf, void *post, void *data); + + +extern ngx_conf_post_t ngx_conf_size_nonzero_post; #define ngx_get_conf(conf_ctx, module) conf_ctx[module.index] diff --git a/src/http/modules/ngx_http_fastcgi_module.c b/src/http/modules/ngx_http_fastcgi_module.c index 7e8953ab1..aad2beb65 100644 --- a/src/http/modules/ngx_http_fastcgi_module.c +++ b/src/http/modules/ngx_http_fastcgi_module.c @@ -336,7 +336,7 @@ static ngx_command_t ngx_http_fastcgi_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_fastcgi_loc_conf_t, upstream.buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("fastcgi_pass_request_headers"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c index ab68b46ee..ec9101b3f 100644 --- a/src/http/modules/ngx_http_grpc_module.c +++ b/src/http/modules/ngx_http_grpc_module.c @@ -317,7 +317,7 @@ static ngx_command_t ngx_http_grpc_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_grpc_loc_conf_t, upstream.buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("grpc_read_timeout"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, diff --git a/src/http/modules/ngx_http_memcached_module.c b/src/http/modules/ngx_http_memcached_module.c index 178140d2f..e7e8871ae 100644 --- a/src/http/modules/ngx_http_memcached_module.c +++ b/src/http/modules/ngx_http_memcached_module.c @@ -93,7 +93,7 @@ static ngx_command_t ngx_http_memcached_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_memcached_loc_conf_t, upstream.buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("memcached_read_timeout"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c index 0ccdf135a..65845ff76 100644 --- a/src/http/modules/ngx_http_mp4_module.c +++ b/src/http/modules/ngx_http_mp4_module.c @@ -374,14 +374,14 @@ static ngx_command_t ngx_http_mp4_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_mp4_conf_t, buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("mp4_max_buffer_size"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, ngx_conf_set_size_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_mp4_conf_t, max_buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("mp4_start_key_frame"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c index 28c530ac3..99b915c52 100644 --- a/src/http/modules/ngx_http_proxy_module.c +++ b/src/http/modules/ngx_http_proxy_module.c @@ -394,7 +394,7 @@ static ngx_command_t ngx_http_proxy_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_proxy_loc_conf_t, upstream.buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("proxy_read_timeout"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, diff --git a/src/http/modules/ngx_http_scgi_module.c b/src/http/modules/ngx_http_scgi_module.c index fd0907c13..95fb7462b 100644 --- a/src/http/modules/ngx_http_scgi_module.c +++ b/src/http/modules/ngx_http_scgi_module.c @@ -184,7 +184,7 @@ static ngx_command_t ngx_http_scgi_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_scgi_loc_conf_t, upstream.buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("scgi_pass_request_headers"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c index 286058fbe..f4cb6765d 100644 --- a/src/http/modules/ngx_http_ssl_module.c +++ b/src/http/modules/ngx_http_ssl_module.c @@ -171,7 +171,7 @@ static ngx_command_t ngx_http_ssl_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_SRV_CONF_OFFSET, offsetof(ngx_http_ssl_srv_conf_t, buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("ssl_verify_client"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1, diff --git a/src/http/modules/ngx_http_tunnel_module.c b/src/http/modules/ngx_http_tunnel_module.c index ddffebbca..d35052e7f 100644 --- a/src/http/modules/ngx_http_tunnel_module.c +++ b/src/http/modules/ngx_http_tunnel_module.c @@ -113,7 +113,7 @@ static ngx_command_t ngx_http_tunnel_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_tunnel_loc_conf_t, upstream.buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("tunnel_read_timeout"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c index 6193c941e..1b7286f50 100644 --- a/src/http/modules/ngx_http_uwsgi_module.c +++ b/src/http/modules/ngx_http_uwsgi_module.c @@ -252,7 +252,7 @@ static ngx_command_t ngx_http_uwsgi_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_uwsgi_loc_conf_t, upstream.buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("uwsgi_pass_request_headers"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c index 7aa96206f..380ee21b2 100644 --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -243,7 +243,7 @@ static ngx_command_t ngx_http_core_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_SRV_CONF_OFFSET, offsetof(ngx_http_core_srv_conf_t, client_header_buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("large_client_header_buffers"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE2, @@ -364,7 +364,7 @@ static ngx_command_t ngx_http_core_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_core_loc_conf_t, client_body_buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("client_body_timeout"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, @@ -421,7 +421,7 @@ static ngx_command_t ngx_http_core_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_LOC_CONF_OFFSET, offsetof(ngx_http_core_loc_conf_t, subrequest_output_buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("aio"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1, diff --git a/src/http/v3/ngx_http_v3_module.c b/src/http/v3/ngx_http_v3_module.c index 139bd65f3..9e5dc4cac 100644 --- a/src/http/v3/ngx_http_v3_module.c +++ b/src/http/v3/ngx_http_v3_module.c @@ -48,7 +48,7 @@ static ngx_command_t ngx_http_v3_commands[] = { ngx_conf_set_size_slot, NGX_HTTP_SRV_CONF_OFFSET, offsetof(ngx_http_v3_srv_conf_t, quic.stream_buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("quic_retry"), NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG, diff --git a/src/mail/ngx_mail_proxy_module.c b/src/mail/ngx_mail_proxy_module.c index f42c9e2a1..4ecc95ea0 100644 --- a/src/mail/ngx_mail_proxy_module.c +++ b/src/mail/ngx_mail_proxy_module.c @@ -62,7 +62,7 @@ static ngx_command_t ngx_mail_proxy_commands[] = { ngx_conf_set_size_slot, NGX_MAIL_SRV_CONF_OFFSET, offsetof(ngx_mail_proxy_conf_t, buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("proxy_timeout"), NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1, diff --git a/src/stream/ngx_stream_core_module.c b/src/stream/ngx_stream_core_module.c index 6556c5a73..11abd9fc2 100644 --- a/src/stream/ngx_stream_core_module.c +++ b/src/stream/ngx_stream_core_module.c @@ -124,7 +124,7 @@ static ngx_command_t ngx_stream_core_commands[] = { ngx_conf_set_size_slot, NGX_STREAM_SRV_CONF_OFFSET, offsetof(ngx_stream_core_srv_conf_t, preread_buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("preread_timeout"), NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1, diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c index 3f896a116..e8c71b7b2 100644 --- a/src/stream/ngx_stream_proxy_module.c +++ b/src/stream/ngx_stream_proxy_module.c @@ -209,7 +209,7 @@ static ngx_command_t ngx_stream_proxy_commands[] = { ngx_conf_set_size_slot, NGX_STREAM_SRV_CONF_OFFSET, offsetof(ngx_stream_proxy_srv_conf_t, buffer_size), - NULL }, + &ngx_conf_size_nonzero_post }, { ngx_string("proxy_downstream_buffer"), NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1, -- 2.47.3