nginx-0.3.1-RELEASE importrelease-0.3.1

    *) Bugfix: the segmentation fault occurred when the signal queue
       overflowed if the "rtsig" method was used; the bug had appeared in
       0.2.0.

    *) Change: correct handling of the "\\", "\"", "\'", and "\$" pairs in
       SSI.

2 files changed, 44 insertions, 17 deletions

diff --git a/src/http/modules/ngx_http_charset_filter_module.c b/src/http/modules/ngx_http_charset_filter_module.c
index 51f115b63..8eee358be 100644
--- a/src/http/modules/ngx_http_charset_filter_module.c
+++ b/src/http/modules/ngx_http_charset_filter_module.c
@@ -75,16 +75,16 @@ static ngx_int_t ngx_http_charset_postconfiguration(ngx_conf_t *cf);
 static ngx_command_t  ngx_http_charset_filter_commands[] = {
 
     { ngx_string("charset"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_SIF_CONF
-                        |NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF
+                        |NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
       ngx_http_set_charset_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
       offsetof(ngx_http_charset_loc_conf_t, charset),
       NULL },
 
     { ngx_string("source_charset"),
-      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_SIF_CONF
-                        |NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF
+                        |NGX_HTTP_LIF_CONF|NGX_CONF_TAKE1,
       ngx_http_set_charset_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
       offsetof(ngx_http_charset_loc_conf_t, source_charset),
diff --git a/src/http/modules/ngx_http_ssi_filter_module.c b/src/http/modules/ngx_http_ssi_filter_module.c
index acbae29eb..5f9ee3a42 100644
--- a/src/http/modules/ngx_http_ssi_filter_module.c
+++ b/src/http/modules/ngx_http_ssi_filter_module.c
@@ -1130,14 +1130,15 @@ ngx_http_ssi_parse(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx)
 
         case ssi_double_quoted_value_state:
             switch (ch) {
+            case '"':
+                state = ssi_postparam_state;
+                break;
+
             case '\\':
                 ctx->saved_state = ssi_double_quoted_value_state;
                 state = ssi_quoted_symbol_state;
-                break;
 
-            case '"':
-                state = ssi_postparam_state;
-                break;
+                /* fall through */
 
             default:
                 ctx->param->value.data[ctx->param->value.len++] = ch;
@@ -1157,14 +1158,15 @@ ngx_http_ssi_parse(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx)
 
         case ssi_quoted_value_state:
             switch (ch) {
+            case '\'':
+                state = ssi_postparam_state;
+                break;
+
             case '\\':
                 ctx->saved_state = ssi_quoted_value_state;
                 state = ssi_quoted_symbol_state;
-                break;
 
-            case '\'':
-                state = ssi_postparam_state;
-                break;
+                /* fall through */
 
             default:
                 ctx->param->value.data[ctx->param->value.len++] = ch;
@@ -1183,6 +1185,20 @@ ngx_http_ssi_parse(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx)
             break;
 
         case ssi_quoted_symbol_state:
+            state = ctx->saved_state;
+
+            if (ch == '\\') {
+                break;
+            }
+
+            if (ch == '"' && state == ssi_double_quoted_value_state) {
+                break;
+            }
+
+            if (ch == '\'' && state == ssi_quoted_value_state) {
+                break;
+            }
+
             ctx->param->value.data[ctx->param->value.len++] = ch;
 
             if (ctx->param->value.len == ctx->value_len) {
@@ -1197,7 +1213,6 @@ ngx_http_ssi_parse(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx)
                 }
             }
 
-            state = ctx->saved_state;
             break;
 
         case ssi_postparam_state:
@@ -1486,13 +1501,25 @@ ngx_http_ssi_evaluate_string(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx,
             }
 
         } else {
-            part.len = 0;
             part.data = &text->data[i];
 
-            while (i < text->len && text->data[i] != '$') {
-                i++;
-                part.len++;
+            for (p = part.data; i < text->len; i++) {
+                ch = text->data[i];
+
+                if (ch == '$') {
+                    if (text->data[i - 1] != '\\') {
+                        break;
+                    }
+
+                    *(p - 1) = ch;
+
+                    continue;
+                }
+
+                *p++ = ch;
             }
+
+            part.len = p - part.data;
         }
 
         len += part.len;