Nginx: fixbug, stack-buffer-overflow, refer to F-Stack#286.

chenwei · chenwei · commit 4c372811c6dc · 2018-11-06T12:06:29.000+08:00
diff --git a/app/nginx-1.11.10/src/event/modules/ngx_ff_host_event_module.c b/app/nginx-1.11.10/src/event/modules/ngx_ff_host_event_module.c
@@ -117,12 +117,13 @@ ngx_ff_epoll_init(ngx_cycle_t *cycle, ngx_msec_t timer)
         ngx_free(event_list);
     }
 
-    event_list = ngx_alloc(sizeof(struct epoll_event), cycle->log);
+    nevents = 64;
+
+    event_list = ngx_alloc(sizeof(struct epoll_event) * nevents, cycle->log);
     if (event_list == NULL) {
         return NGX_ERROR;
     }
 
-    nevents = 8;
     return NGX_OK;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -117,12 +117,13 @@ ngx_ff_epoll_init(ngx_cycle_t *cycle, ngx_msec_t timer)`
`117`	`117`	`ngx_free(event_list);`
`118`	`118`	`}`
`119`	`119`
`120`		`- event_list = ngx_alloc(sizeof(struct epoll_event), cycle->log);`
	`120`	`+ nevents = 64;`
	`121`	`+`
	`122`	`+ event_list = ngx_alloc(sizeof(struct epoll_event) * nevents, cycle->log);`
`121`	`123`	`if (event_list == NULL) {`
`122`	`124`	`return NGX_ERROR;`
`123`	`125`	`}`
`124`	`126`
`125`		`- nevents = 8;`
`126`	`127`	`return NGX_OK;`
`127`	`128`	`}`
`128`	`129`