commit b767540492e8c79a58bc26034d3bab2f708b7bd1
Author:     Maxim Dounin <mdounin@mdounin.ru>
AuthorDate: Fri Jun 19 22:54:27 2026 +0300
Commit:     Roman Arutyunyan <arutyunyan.roman@gmail.com>
CommitDate: Wed Jul 15 19:51:22 2026 +0400

    Script: buffer overrun protection.
    
    With this change, all script copy operations now check if there is
    enough room in the buffer.  To do so, the script engine now provides the
    e->end pointer, which specifies expected buffer end, and each copy
    operation is checked against it with the ngx_http_script_check_length()
    function.
    
    The e->end pointer is optional and only checked when set, thus
    introducing no incompatible API changes.  All standard functions were
    updated to use it, notably ngx_http_complex_value(), ngx_http_script_run(),
    ngx_http_script_regex_start_code(), ngx_http_script_complex_value_code().
    Direct script evaluation in the proxy, fastcgi, scgi, uwsgi, grpc proxy,
    index, and try_files modules will be updated by a separate patch.
    
    In particular, this catches issues as observed when evaluating variables
    with side effects, such as in the following configuration:
    
        map $uri $map {
            ~(?<capture>.*) $capture;
        }
    
        set $capture "";
        set $temp "$capture $map";
    
    As well as when evaluating non-cacheable variables, where length of a
    variable might change between length and copy codes, such as in the
    following configuration:
    
        map prefix:$capture $map_volatile {
            volatile;
            ~(?<capture>.*) $capture;
        }
    
        set $capture "";
        set $temp "$map_volatile";
    
    Similar changes were made in the stream module.
    
    Signed-off-by: Roman Arutyunyan <arut@nginx.com>
    Origin: <https://freenginx.org/hg/nginx/rev/d172f506ab5f>

 src/http/ngx_http_script.c     | 63 ++++++++++++++++++++++++++++++++++++++++++
 src/http/ngx_http_script.h     |  4 +++
 src/stream/ngx_stream_script.c | 45 ++++++++++++++++++++++++++++++
 src/stream/ngx_stream_script.h |  5 ++++
 4 files changed, 117 insertions(+)