← Back to branch summary

~ubuntu-branches/ubuntu/trusty/nginx/trusty-updates

« back to all changes in this revision

Viewing changes to src/http/ngx_http_parse.c

  • Committer: Package Import Robot
  • Author(s): Cyril Lavier, Cyril Lavier
  • Date: 2012-06-27 13:52:03 UTC
  • mfrom: (4.2.51 sid)
  • Revision ID: package-import@ubuntu.com-20120627135203-82rzqkajfpo1m77u
Tags: 1.2.1-2
[Cyril Lavier]
* Urgency set to medium, security bug in naxsi module, fix via upstream.
* debian/modules/naxsi:
  + Updated naxsi module to version 0.46-1 fixing the following security
    issue : potential file disclosure in nx_extract.

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/http/ngx_http_parse.c
543
543
 
544
544
            switch (ch) {
545
545
            case '/':
 
546
#if (NGX_WIN32)
 
547
                if (r->uri_ext == p) {
 
548
                    r->complex_uri = 1;
 
549
                    state = sw_uri;
 
550
                    break;
 
551
                }
 
552
#endif
546
553
                r->uri_ext = NULL;
547
554
                state = sw_after_slash_in_uri;
548
555
                break;
1117
1124
            switch(ch) {
1118
1125
#if (NGX_WIN32)
1119
1126
            case '\\':
 
1127
                if (u - 2 >= r->uri.data
 
1128
                    && *(u - 1) == '.' && *(u - 2) != '.')
 
1129
                {
 
1130
                    u--;
 
1131
                }
 
1132
 
1120
1133
                r->uri_ext = NULL;
1121
1134
 
1122
1135
                if (p == r->uri_start + r->uri.len) {
1134
1147
                break;
1135
1148
#endif
1136
1149
            case '/':
 
1150
#if (NGX_WIN32)
 
1151
                if (u - 2 >= r->uri.data
 
1152
                    && *(u - 1) == '.' && *(u - 2) != '.')
 
1153
                {
 
1154
                    u--;
 
1155
                }
 
1156
#endif
1137
1157
                r->uri_ext = NULL;
1138
1158
                state = sw_slash;
1139
1159
                *u++ = ch;