Nil-pointer panic in NewHTTPRequest: req.Header.Set called before err check
- 主要语言
- Go
- 星标
- 20
- 派生
- 26
- PR 合并指标
- 30 天内没有已合并 PR
描述
## Problem
`NewHTTPRequest` in `code/go/0chain.net/core/util/http.go:25-30` calls `req.Header.Set(...)` five times without checking the `err` returned by `http.NewRequest`. If `http.NewRequest` returns a nil `req` with a non-nil `err` (invalid method or malformed URL), the first `req.Header.Set` at line 26 dereferences a nil pointer and panics.
## Steps
1. Call any code path that reaches `NewHTTPRequest` with a bad method or malformed URL (e.g. `"\x7f"` scheme, control chars).
2. `http.NewRequest` returns `nil, err`.
3. Line 26 panics: `runtime error: invalid memory address or nil pointer dereference`.
## Expected
Return the error before touching `req`.
## Actual
Panic at `code/go/0chain.net/core/util/http.go:26` (`req.Header.Set`).
## Fix sketch
```go
req, err := http.NewRequest(method, url, bytes.NewBuffer(data))
if err != nil {
return nil, nil, nil, err
}
req.Header.Set(...)
```
## Environment
Repo `0chain/blobber` staging branch, `go.mod`: `go 1.22.0`, toolchain `go1.22.5`.
Related smell in same file: `defer cncl()` at line 66 sits inside the retry `for` loop, so cancels accumulate for all iterations instead of releasing per-attempt.
Thanks for maintaining 0chain/blobber!
贡献指南
这个仓库没有索引到贡献指南
调研方向
该错误位于 code/go/0chain.net/core/util/http.go 的第 25-30 行。首先,找到 NewHTTPRequest 函数。修复方法是将 req.Header.Set 调用移到 http.NewRequest 的错误检查之后。通过编写一个测试来验证更改,该测试使用无效 URL 调用 NewHTTPRequest 以触发错误路径,并确保它返回错误而不是引发 panic。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- go
- 领域
- backend
- Issue 类型
- 缺陷
- 难度
- 1/5
- 预计耗时
- 1 小时以内
- 活跃度
- 冷清
- 描述清晰度
- 描述清楚
- 新手友好度
- 90/100