Skip to content

Commit 5743f9d

Browse files
Avoiding arithmetic ops with NULL pointer in nxt_http_arguments_parse
Can be reproduced by test/test_variables.py::test_variables_dynamic_arguments with enabled UndefinedBehaviorSanitizer: src/nxt_http_request.c:961:17: runtime error: applying zero offset to null pointer #0 0x1050d95a4 in nxt_http_arguments_parse nxt_http_request.c:961 nginx#1 0x105102bf8 in nxt_http_var_arg nxt_http_variables.c:621 nginx#2 0x104f95d74 in nxt_var_interpreter nxt_var.c:507 nginx#3 0x104f98c98 in nxt_tstr_query nxt_tstr.c:265 nginx#4 0x1050abfd8 in nxt_router_access_log_writer nxt_router_access_log.c:194 nginx#5 0x1050d81f4 in nxt_http_request_close_handler nxt_http_request.c:838 nginx#6 0x104fcdc48 in nxt_event_engine_start nxt_event_engine.c:542 nginx#7 0x104fba838 in nxt_thread_trampoline nxt_thread.c:126 nginx#8 0x18133e030 in _pthread_start+0x84 (libsystem_pthread.dylib:arm64e+0x7030) nginx#9 0x181338e38 in thread_start+0x4 (libsystem_pthread.dylib:arm64e+0x1e38) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/nxt_http_request.c:961:17 Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
1 parent 2da49ab commit 5743f9d

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

src/nxt_http_request.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -946,6 +946,10 @@ nxt_http_arguments_parse(nxt_http_request_t *r)
946946
return NULL;
947947
}
948948

949+
if (nxt_slow_path(r->args->start == NULL)) {
950+
goto end;
951+
}
952+
949953
hash = NXT_HTTP_FIELD_HASH_INIT;
950954
name = NULL;
951955
name_length = 0;
@@ -1026,6 +1030,8 @@ nxt_http_arguments_parse(nxt_http_request_t *r)
10261030
}
10271031
}
10281032

1033+
end:
1034+
10291035
r->arguments = args;
10301036

10311037
return args;

0 commit comments

Comments
 (0)