Re: [nginx] setting variable cause core when used by lua

[Maxim Dounin]

Hello!

On Fri, Feb 17, 2017 at 11:36:59AM +0800, 洪志道 wrote:

> It works well now, thank you!

Committed, thanks for testing.
http://hg.nginx.org/nginx/rev/87cf6ddb41c2

-- 
Maxim Dounin
http://nginx.org/
___
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel

Re: [nginx] setting variable cause core when used by lua

[洪志道]

It works well now, thank you!

2017-02-16 22:14 GMT+08:00 Maxim Dounin :

> Hello!
>
> On Thu, Feb 16, 2017 at 03:51:24PM +0800, 洪志道 wrote:
>
> > Hi.
> >
> > diff -r da46bfc484ef src/http/ngx_http_variables.c
> > --- a/src/http/ngx_http_variables.c Mon Feb 13 21:45:01 2017 +0300
> > +++ b/src/http/ngx_http_variables.c Wed Feb 08 10:31:53 2017 +0800
> > @@ -783,6 +783,10 @@
> >  ssize_ts, *sp;
> >  ngx_str_t  val;
> >
> > +if (v->data == NULL) {
> > +return;
> > +}
> > +
> >  val.len = v->len;
> >  val.data = v->data;
> >
> >
> > The following will cause core file, I think it's better to deal with in
> > nginx.
> >
> > server {
> > listen  8000;
> >
> > location / {
> > content_by_lua_block {
> > ngx.var.limit_rate = size;  # size is undefined.
> > ngx.say('hello lua');
> > }
> > }
>
> This looks like a bug in ngx_parse_size(), it incorrectly assumes
> that the input string is at least 1 character long.  And I believe
> it can be triggered without Lua too.
>
> Please test if the following patch fixes things for you:
>
> # HG changeset patch
> # User Maxim Dounin 
> # Date 1487253948 -10800
> #  Thu Feb 16 17:05:48 2017 +0300
> # Node ID 51c8df305d083bc57828f68cd6e709cacdcc41c0
> # Parent  be00ca08e41a69e585b6aff70a725ed6c9e1a876
> Fixed ngx_parse_size() / ngx_parse_offset() with 0-length strings.
>
> diff --git a/src/core/ngx_parse.c b/src/core/ngx_parse.c
> --- a/src/core/ngx_parse.c
> +++ b/src/core/ngx_parse.c
> @@ -17,6 +17,11 @@ ngx_parse_size(ngx_str_t *line)
>  ssize_t  size, scale, max;
>
>  len = line->len;
> +
> +if (len == 0) {
> +return NGX_ERROR;
> +}
> +
>  unit = line->data[len - 1];
>
>  switch (unit) {
> @@ -58,6 +63,11 @@ ngx_parse_offset(ngx_str_t *line)
>  size_t  len;
>
>  len = line->len;
> +
> +if (len == 0) {
> +return NGX_ERROR;
> +}
> +
>  unit = line->data[len - 1];
>
>  switch (unit) {
>
>
> --
> Maxim Dounin
> http://nginx.org/
> ___
> nginx-devel mailing list
> nginx-devel@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx-devel
>
___
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel

Re: [nginx] setting variable cause core when used by lua

[soul11201]

i think this is a feature not a bug

2017-02-16 16:01 GMT+08:00 洪志道 :

> Sorry, sent too much.
>
> 2017-02-16 16:00 GMT+08:00 洪志道 :
>
>> Hi!
>>
>> diff -r da46bfc484ef src/http/ngx_http_variables.c
>> --- a/src/http/ngx_http_variables.c Mon Feb 13 21:45:01 2017 +0300
>> +++ b/src/http/ngx_http_variables.c Wed Feb 08 10:31:53 2017 +0800
>> @@ -783,6 +783,10 @@
>>  ssize_ts, *sp;
>>  ngx_str_t  val;
>>
>> +if (v->data == NULL) {
>> +return;
>> +}
>> +
>>  val.len = v->len;
>>  val.data = v->data;
>>
>>
>> The following will cause core file, I think it's better to deal with in
>> nginx.
>>
>> server {
>> listen  8000;
>>
>> location / {
>> content_by_lua_block {
>> ngx.var.limit_rate = size;  # size is undefined.
>> ngx.say('hello lua');
>> }
>> }
>>
>>
>> == set handler in lua-module 
>>  if (value_type == LUA_TNIL) {
>> vv->valid = 0;
>> vv->not_found = 1;
>> vv->no_cacheable = 0;
>> vv->data = NULL;
>> vv->len = 0;
>>
>> } else {
>> vv->valid = 1;
>> vv->not_found = 0;
>> vv->no_cacheable = 0;
>>
>> vv->data = val;
>> vv->len = len;
>> }
>>
>> v->set_handler(r, vv, v->data);
>> ===
>>
>> Thanks.
>> B.R.
>>
>
>
> ___
> nginx-devel mailing list
> nginx-devel@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx-devel
>



-- 

-
http://blog.soul11201.com
___
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel

Re: [nginx] setting variable cause core when used by lua

[洪志道]

Sorry, sent too much.

2017-02-16 16:00 GMT+08:00 洪志道 :

> Hi!
>
> diff -r da46bfc484ef src/http/ngx_http_variables.c
> --- a/src/http/ngx_http_variables.c Mon Feb 13 21:45:01 2017 +0300
> +++ b/src/http/ngx_http_variables.c Wed Feb 08 10:31:53 2017 +0800
> @@ -783,6 +783,10 @@
>  ssize_ts, *sp;
>  ngx_str_t  val;
>
> +if (v->data == NULL) {
> +return;
> +}
> +
>  val.len = v->len;
>  val.data = v->data;
>
>
> The following will cause core file, I think it's better to deal with in
> nginx.
>
> server {
> listen  8000;
>
> location / {
> content_by_lua_block {
> ngx.var.limit_rate = size;  # size is undefined.
> ngx.say('hello lua');
> }
> }
>
>
> == set handler in lua-module 
>  if (value_type == LUA_TNIL) {
> vv->valid = 0;
> vv->not_found = 1;
> vv->no_cacheable = 0;
> vv->data = NULL;
> vv->len = 0;
>
> } else {
> vv->valid = 1;
> vv->not_found = 0;
> vv->no_cacheable = 0;
>
> vv->data = val;
> vv->len = len;
> }
>
> v->set_handler(r, vv, v->data);
> ===
>
> Thanks.
> B.R.
>
___
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel