Possibly buffer overflow

sadmedved · 2014-07-17T19:06:10+00:00

Hello! On Mon, Jul 21, 2014 at 8:09 AM, marcin.stragowski wrote: > Hi, thank you for your response .. i tried to implement the feature as you > sugge...

Possibly buffer overflow

sadmedved

Hello,

to deal with php bugs i try to use the config below. But when i request php script that generate 500 error i can't get the full headers from lua:

2014/07/17 14:53:21 [error] 22678#0: *85939 lua entry thread aborted: runtime error: userdata length overflow

stack traceback:

coroutine 0:

[C]: in function 'raw_header'

[string "content_by_lua"]:3: in function <[string "content_by_lua"]:1>, client: 66.66.66.66, server: domain.com, request: "GET /g.php?gogogo HTTP/1.1", upstream: "fastcgi://unix:/projects/var/php-fpm.sock", host: "domain.com"

When i write the content of ngx.req.raw_header() or $echo_client_request_headers to file i see that after real request headers there comes some random stuff from nginx memory.

location ~* \.php$ {

try_files $uri /error_handler_404;

fastcgi_buffering off;

include php-fpm.conf;

fastcgi_intercept_errors on;

error_page 500 = /error_handler_500;

}

location /error_handler_500 {

internal;

content_by_lua '

ngx.status = ngx.HTTP_INTERNAL_SERVER_ERROR

ngx.say(ngx.req.raw_header())

ngx.exit(ngx.HTTP_OK)

access_log /projects/logs/web/bad/php-500.log block_format;

}

lordnynex

Hi,

I'd like to try and reproduce this. What version of openresty are you seeing this issue on?

On Thu, Jul 17, 2014 at 4:06 AM, <sadm...@gmail.com> wrote:

Hello,
to deal with php bugs i try to use the config below. But when i request php script that generate 500 error i can't get the full headers from lua:

2014/07/17 14:53:21 [error] 22678#0: *85939 lua entry thread aborted: runtime error: userdata length overflow
stack traceback:
coroutine 0:
[C]: in function 'raw_header'

[string "content_by_lua"]:3: in function <[string "content_by_lua"]:1>, client: 66.66.66.66, server: domain.com, request: "GET /g.php?gogogo HTTP/1.1", upstream: "fastcgi://unix:/projects/var/php-fpm.sock", host: "domain.com"

When i write the content of ngx.req.raw_header() or $echo_client_request_headers to file i see that after real request headers there comes some random stuff from nginx memory.

location ~* \.php$ {
try_files $uri /error_handler_404;
fastcgi_buffering off;

include php-fpm.conf;

fastcgi_intercept_errors on;

error_page 500 = /error_handler_500;
}

location /error_handler_500 {
internal;
content_by_lua '
ngx.status = ngx.HTTP_INTERNAL_SERVER_ERROR

ngx.say(ngx.req.raw_header())
ngx.exit(ngx.HTTP_OK)
';
access_log /projects/logs/web/bad/php-500.log block_format;
}

.

agentzh

Hello!

On Thu, Jul 17, 2014 at 4:06 AM,  sadmedved wrote:
> to deal with php bugs i try to use the config below. But when i request php
> script that generate 500 error i can't get the full headers from lua:
>
> 2014/07/17 14:53:21 [error] 22678#0: *85939 lua entry thread aborted:
> runtime error: userdata length overflow

Will you create a minimal and self-contained example that can
reproduce the issue in others boxes (in particular, my box)?

Also, please check and provide the version of your ngx_lua module.
(Please upgrade to the latest version if you're not using the latest.)

Thanks!
-agentzh

sadmedved

Hello,

i used openresty/1.5.8.1 on centos6-32bit with php-fpm 5.5.8 through fastcgi interface connected with unix socket.

Now i upgraded to the last version openresty/1.7.2.1 and error is still there.

What i use:

1. Php script with undefined function

go.php

<?php

silly_undefined_func();

2. Config like these one.

server {

listen *:80;

server_name testdomain.com;

root /projects/web/testdomain.com/public;

location ~* \.php$ {

fastcgi_buffering off;

fastcgi_pass unix:/projects/var/php-fpm.sock;

fastcgi_param QUERY_STRING $query_string;

fastcgi_param REQUEST_METHOD $request_method;

fastcgi_param CONTENT_TYPE $content_type if_not_empty;

fastcgi_param CONTENT_LENGTH $content_length if_not_empty;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_param SCRIPT_NAME $fastcgi_script_name;

fastcgi_param PATH_INFO $fastcgi_path_info;

fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;

fastcgi_param REQUEST_URI $request_uri;

fastcgi_param DOCUMENT_URI $document_uri;

fastcgi_param DOCUMENT_ROOT $document_root;

fastcgi_param SERVER_PROTOCOL $server_protocol;

fastcgi_param GATEWAY_INTERFACE CGI/1.1;

fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;

fastcgi_param REMOTE_ADDR $remote_addr;

fastcgi_param REMOTE_PORT $remote_port;

fastcgi_param SERVER_ADDR $server_addr;

fastcgi_param SERVER_PORT $server_port;

fastcgi_param SERVER_NAME $server_name;

fastcgi_intercept_errors on;

error_page 500 = /error_handler_500;

}

location /error_handler_500 {

internal;

content_by_lua '

ngx.status = ngx.HTTP_INTERNAL_SERVER_ERROR

ok, err = ngx.say(ngx.req.raw_header()) #when i use string.len(ngx.req.raw_header()) i get something like 14454

if not ok then

ngx.say(err)

end

ngx.exit(ngx.HTTP_OK)

access_log /projects/logs/web/bad/php-500.log;

}

пятница, 18 июля 2014 г., 0:30:25 UTC+4 пользователь agentzh написал:

Hello!

On Thu, Jul 17, 2014 at 4:06 AM, sadmedved wrote:
> to deal with php bugs i try to use the config below. But when i request php
> script that generate 500 error i can't get the full headers from lua:
>
> 2014/07/17 14:53:21 [error] 22678#0: *85939 lua entry thread aborted:
> runtime error: userdata length overflow

Will you create a minimal and self-contained example that can
reproduce the issue in others boxes (in particular, my box)?

Also, please check and provide the version of your ngx_lua module.
(Please upgrade to the latest version if you're not using the latest.)

Thanks!
-agentzh

agentzh

Hello!

On Fri, Jul 18, 2014 at 12:01 AM,  sadmedved wrote:
> i used openresty/1.5.8.1 on centos6-32bit with php-fpm 5.5.8 through fastcgi
> interface connected with unix socket.
> Now i upgraded to the last version openresty/1.7.2.1 and error is still
> there.
> What i use:
>

Thank you for your test case and report! I've already reproduced the
issue on my side.

php-fpm is not really needed to reproduce this. This issue is due to
ngx_fastcgi (and other modules like ngx_proxy) can change
r->header_end to point to its own buffer while ngx.req.raw_header()
makes use of r->header_end. This leads to buffer overflow.

I've already fixed the issue by avoiding use of r->header_end (by
switching to r->header_in->pos) in my local ngx_lua tree. I'm going to
commit it soon.

What name should I use in the commit message (and later change log)
when referring to you? Like sadmedved?

Thanks!
-agentzh

sadmedved

Thanks for your product and efforts in open source!

Yeah sadmedved is fine.

суббота, 19 июля 2014 г., 3:51:32 UTC+4 пользователь agentzh написал:

Hello!

On Fri, Jul 18, 2014 at 12:01 AM, sadmedved wrote:
> i used openresty/1.5.8.1 on centos6-32bit with php-fpm 5.5.8 through fastcgi
> interface connected with unix socket.
> Now i upgraded to the last version openresty/1.7.2.1 and error is still
> there.
> What i use:
>

Thank you for your test case and report! I've already reproduced the
issue on my side.

php-fpm is not really needed to reproduce this. This issue is due to
ngx_fastcgi (and other modules like ngx_proxy) can change
r->header_end to point to its own buffer while ngx.req.raw_header()
makes use of r->header_end. This leads to buffer overflow.

I've already fixed the issue by avoiding use of r->header_end (by
switching to r->header_in->pos) in my local ngx_lua tree. I'm going to
commit it soon.

What name should I use in the commit message (and later change log)
when referring to you? Like sadmedved?

Thanks!
-agentzh

agentzh

Hello!

On Fri, Jul 18, 2014 at 4:51 PM, Yichun Zhang (agentzh) wrote:
> I've already fixed the issue by avoiding use of r->header_end (by
> switching to r->header_in->pos) in my local ngx_lua tree. I'm going to
> commit it soon.
>

Just committed the patch to git master:

    https://github.com/openresty/lua-nginx-module/commit/b5d23b9

Also, I've noticed another issue for the special case that LF instead
of CR LF is used as the line terminator in the original request
header. I also fixed it:

    https://github.com/openresty/lua-nginx-module/commit/f3870f6

Will you try these 2 patches out on your side?

Thanks!
-agentzh

sadmedved

I've already incorporated the last version of ngx_http_lua_headers.c to my production system.

All my cases with ngx.req.raw_header() now work as expected.

But the same bug possibly still in $echo_client_request_headers variable from echo-nginx-module which is part of openresty.

I didnt make accent on it besides the first message because it has duplicate functionality.

Though I can't be absolutely sure because i just downloaded one file (ngx_http_lua_headers.c)

суббота, 19 июля 2014 г., 9:34:26 UTC+4 пользователь agentzh написал:

Hello!

On Fri, Jul 18, 2014 at 4:51 PM, Yichun Zhang (agentzh) wrote:
> I've already fixed the issue by avoiding use of r->header_end (by
> switching to r->header_in->pos) in my local ngx_lua tree. I'm going to
> commit it soon.
>

Just committed the patch to git master:

https://github.com/openresty/lua-nginx-module/commit/b5d23b9

Also, I've noticed another issue for the special case that LF instead
of CR LF is used as the line terminator in the original request
header. I also fixed it:

https://github.com/openresty/lua-nginx-module/commit/f3870f6

Will you try these 2 patches out on your side?

Thanks!
-agentzh

agentzh

Hello!

On Sat, Jul 19, 2014 at 5:56 AM,  sadmedved wrote:
> I've already incorporated the last version of ngx_http_lua_headers.c to my
> production system.
> All my cases with ngx.req.raw_header() now work as expected.
>

Cool :)

> But the same bug possibly still in $echo_client_request_headers variable
> from echo-nginx-module which is part of openresty.
> I didnt make accent on it besides the first message because it has duplicate
> functionality.
>

Yes, I was aware of this. I submitted similar patches to ngx_echo's
git repos shortly after I submitted the patches to ngx_lua's (about 11
hours ago):

    https://github.com/openresty/echo-nginx-module/commits/master

> Though I can't be absolutely sure because i just downloaded one file
> (ngx_http_lua_headers.c)
>

Better apply the patches instead of using the whole .c files because
it might contain unrelated changes (or just use the whole new ngx_lua
code base). But if it compiles okay for you, then it should be
functionally fine most of the time.

Regards,
-agentzh