rpms/nginx
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Debrand for AlmaLinux

Browse Source
This commit is contained in:
Eduard Abdullin 2026-08-24 23:42:45 +00:00 committed by root
commit 9f8b21ee98
3 changed files with 135 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
SOURCES/0016-Avoid-duplicate-subrequest-finalization.patch Normal file
View File

@ -0,0 +1,66 @@
From 13c54029cf3a3a6dbb954ee839665de00f95aa5b Mon Sep 17 00:00:00 2001
From: Roman Arutyunyan <arut@nginx.com>
Date: Mon, 29 Jun 2026 21:49:27 +0400
Subject: [PATCH] Avoid duplicate subrequest finalization
Previously, if a subrequest was posted twice, it could be finalized in
both calls, excessively reducing r->main->count and potentially leading
to a use-after-free.
The fix is to avoid posting a request if it's already posted. Also,
as a hardening measure, r->write_event_handler is now reset to a no-op
handler during active subrequest finalization.
The problem manifests itself in ngx_http_ssi_filter_module during
unbuffered proxying. If a subrequest is created for an SSI include
statement while the main request has some data postponed by another
include, this subrequest becomes double-posted when the main request
data is flushed. The first post comes from ngx_http_subrequest() and
the second one comes from ngx_http_postpone_filter(). In case of a
quick subrequest finalization, the above mentioned problem happens.
Reported by P4P3R-HAK.
---
src/http/ngx_http_request.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 85571a0..a28f569 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -2455,6 +2455,14 @@ ngx_http_post_request(ngx_http_request_t *r, ngx_http_posted_request_t *pr)
{
ngx_http_posted_request_t **p;
+ for (p = &r->main->posted_requests; *p; p = &(*p)->next) {
+ if ((*p)->request == r) {
+ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+ "http request already posted");
+ return NGX_OK;
+ }
+ }
+
if (pr == NULL) {
pr = ngx_palloc(r->pool, sizeof(ngx_http_posted_request_t));
if (pr == NULL) {
@@ -2465,8 +2473,6 @@ ngx_http_post_request(ngx_http_request_t *r, ngx_http_posted_request_t *pr)
pr->request = r;
pr->next = NULL;
- for (p = &r->main->posted_requests; *p; p = &(*p)->next) { /* void */ }
-
*p = pr;
return NGX_OK;
@@ -2586,6 +2592,8 @@ ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
r->main->count--;
+ r->write_event_handler = ngx_http_request_empty_handler;
+
if (pr->postponed && pr->postponed->request == r) {
pr->postponed = pr->postponed->next;
}
--
2.44.0

51
SOURCES/0017-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch Normal file
View File

@ -0,0 +1,51 @@
From 805de017e6ba2d81208eabdb74643b0a52eb896b Mon Sep 17 00:00:00 2001
From: Pavel Pautov <p.pautov@f5.com>
Date: Fri, 15 May 2026 00:48:50 -0700
Subject: [PATCH] Fixed uninitialized memory read caused by stale regex
captures.
When ngx_http_regex_exec() reallocates r->captures array, it doesn't update
r->ncaptures value, if regex didn't match. So the next use of unnamed regex
capture triggers uninitialized read and potential buffer overrun.
This config demonstrates the issue:
map test $my_map {
volatile;
~mismatch(.*) 1; # reallocates r->captures in subrequests
default "";
}
server {
location ~(.*) { # sets r->ncaptures
slice 50;
# $1 will read from uninitialized memory in slice subrequests
proxy_set_header Test $my_map$1;
proxy_set_header Range $slice_range;
proxy_pass http://backend;
}
}
The issue was introduced by 746fba0d79c6.
---
src/http/ngx_http_variables.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c
index 16ffda3..47d7848 100644
--- a/src/http/ngx_http_variables.c
+++ b/src/http/ngx_http_variables.c
@@ -2624,6 +2624,7 @@ ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
if (r->captures == NULL || r->realloc_captures) {
r->realloc_captures = 0;
+ r->ncaptures = 0;
r->captures = ngx_palloc(r->pool, len * sizeof(int));
if (r->captures == NULL) {
--
2.44.0

20
SPECS/nginx.spec
View File

@ -30,7 +30,7 @@
Name: nginx
Epoch: 1
Version: 1.24.0
Release: 3%{?dist}.3.alma.1
Release: 3%{?dist}.4.alma.1
Summary: A high performance web server and reverse proxy server
Group: System Environment/Daemons
@ -114,6 +114,14 @@ Patch14: 0014-Added-max_headers-directive.patch
# upstream patch - https://github.com/nginx/nginx/commit/26d824ec3a2f819300edce0ab3b055751c9843ff.patch
Patch15: 0015-Upstream-limit-header-length-for-HTTP-2-and-gRPC.patch
# https://redhat.atlassian.net/browse/RHEL-219313
# upstream patch - https://github.com/nginx/nginx/commit/ddde692db11ab8238e9ca661007f64c9f6d764d2.patch
Patch16: 0016-Avoid-duplicate-subrequest-finalization.patch
# https://redhat.atlassian.net/browse/RHEL-217956
# upstream patch - https://github.com/nginx/nginx/commit/b99f804ad38a60ceb07bc429598d5b2c4e70e336.patch
Patch17: 0017-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch
%if 0%{?with_gperftools}
BuildRequires: gperftools-devel
%endif
@ -280,6 +288,8 @@ Requires: zlib-devel
%patch -P13 -p1
%patch -P14 -p1
%patch -P15 -p1
%patch -P16 -p1
%patch -P17 -p1
cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} .
@ -592,9 +602,15 @@ fi
%{nginx_srcdir}/
%changelog
* Mon Jul 13 2026 Eduard Abdullin <eabdullin@almalinux.org> - 1:1.24.0-3.3.alma.1
* Mon Aug 24 2026 Eduard Abdullin <eabdullin@almalinux.org> - 1:1.24.0-3.4.alma.1
- Debrand for AlmaLinux
* Sun Aug 09 2026 Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-3.4
- Resolves: RHEL-217957 - nginx:1.24/nginx: NGINX: Memory disclosure and
denial of service in ngx_http_slice_module (CVE-2026-60005)
- Resolves: RHEL-219309 - nginx:1.24/nginx: NGINX: Heap buffer over-read
allows memory modification or denial of service (CVE-2026-56434)
* Tue Jul 07 2026 Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-3.3
- Resolves: RHEL-191779 - nginx: "HTTP/2 bomb" nginx fix breaks module ABI
causing crashes