openresty / openresty/stream-lua-nginx-module

Potential NULL dereference issue in the function ngx_stream_lua_sema_handler (ngx_stream_lua_semaphore.c)

Open
#369 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
749
Forks
210
Avg merge
4h 31m
Merged PRs (30d)
3

Description

Issue
Fix potential null pointer dereference in ngx_stream_lua_sema_handler.

Description
The current implementation of ngx_stream_lua_sema_handler function lacks verification of the return value from ngx_stream_lua_get_req. It can potentially lead to a NULL pointer dereference, causing unexpected crashes:

494: r = ngx_stream_lua_get_req(wait_co_ctx->co);
495:
496: ctx = ngx_stream_lua_get_module_ctx(r, ngx_stream_lua_module);
497: ngx_stream_lua_assert(ctx != NULL);

r is dereferenced in 496 without verifying that it is not NULL.

Patch

--- ngx_stream_lua_semaphore.c
+++ ngx_stream_lua_semaphore_patch.c
@@ -492,6 +492,10 @@
         }
 
         r = ngx_stream_lua_get_req(wait_co_ctx->co);
+        
+        if (r == NULL) {
+            return luaL_error(L, "no request found");
+        }
 
         ctx = ngx_stream_lua_get_module_ctx(r, ngx_stream_lua_module);
         ngx_stream_lua_assert(ctx != NULL);

Expected Result
After applying this patch, the function properly handles the case when the request object (r) is NULL and gracefully returns an error to Lua instead of crashing.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in ngx_stream_lua_semaphore.c at ngx_stream_lua_sema_handler, especially the ngx_stream_lua_get_req call around lines 494-496. Check the NULL case and the surrounding error-handling conventions; done means a missing request no longer reaches ngx_stream_lua_get_module_ctx or causes a crash, and Lua receives an error.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, lua, nginx
Domain
networking
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.