francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
47 lines
1.7 KiB
Diff
47 lines
1.7 KiB
Diff
From 7b45e652cc7e91fbc60cbb5f41eb4608e706bc03 Mon Sep 17 00:00:00 2001
|
|
From: Sergey Kandaurov <pluknet@nginx.com>
|
|
Date: Wed, 29 Apr 2026 21:56:51 +0400
|
|
Subject: [PATCH 1/2] Upstream: reset parsing state after invalid status line
|
|
|
|
Previously, it was possible to start parsing headers with a wrong
|
|
parsing state after status line was not recognized, as a fallback
|
|
used in the scgi and uwsgi modules.
|
|
|
|
Reported by Leo Lin.
|
|
|
|
CVE: CVE-2026-42946
|
|
Upstream-Status: Backport [https://github.com/nginx/nginx/commit/baef7fdac28e4e1fe26509b50b8d15603393e28e]
|
|
Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
|
|
---
|
|
src/http/modules/ngx_http_scgi_module.c | 1 +
|
|
src/http/modules/ngx_http_uwsgi_module.c | 1 +
|
|
2 files changed, 2 insertions(+)
|
|
|
|
diff --git a/src/http/modules/ngx_http_scgi_module.c b/src/http/modules/ngx_http_scgi_module.c
|
|
index 9fc18dc..3259820 100644
|
|
--- a/src/http/modules/ngx_http_scgi_module.c
|
|
+++ b/src/http/modules/ngx_http_scgi_module.c
|
|
@@ -1029,6 +1029,7 @@ ngx_http_scgi_process_status_line(ngx_http_request_t *r)
|
|
|
|
if (rc == NGX_ERROR) {
|
|
u->process_header = ngx_http_scgi_process_header;
|
|
+ r->state = 0;
|
|
return ngx_http_scgi_process_header(r);
|
|
}
|
|
|
|
diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c
|
|
index e4f721b..93bcad7 100644
|
|
--- a/src/http/modules/ngx_http_uwsgi_module.c
|
|
+++ b/src/http/modules/ngx_http_uwsgi_module.c
|
|
@@ -1257,6 +1257,7 @@ ngx_http_uwsgi_process_status_line(ngx_http_request_t *r)
|
|
|
|
if (rc == NGX_ERROR) {
|
|
u->process_header = ngx_http_uwsgi_process_header;
|
|
+ r->state = 0;
|
|
return ngx_http_uwsgi_process_header(r);
|
|
}
|
|
|
|
--
|
|
2.43.0
|
|
|