Skip to content

Commit fdc4675

Browse files
NJS: avoiding arithmetic ops with NULL pointer in r->args
Can be reproduced by test/test_rewrite.py::test_rewrite_njs with enabled UndefinedBehaviorSanitizer: src/nxt_http_js.c:169:52: runtime error: applying zero offset to null pointer #0 0x10255b044 in nxt_http_js_ext_get_args nxt_http_js.c:169 #1 0x102598ad0 in njs_value_property njs_value.c:1175 #2 0x10259c2c8 in njs_vm_object_prop njs_vm.c:1398 #3 0x102559d74 in nxt_js_call nxt_js.c:445 #4 0x1023c0da0 in nxt_tstr_query nxt_tstr.c:276 #5 0x102516ec4 in nxt_http_rewrite nxt_http_rewrite.c:56 #6 0x1024fd86c in nxt_http_request_action nxt_http_request.c:565 #7 0x1024d71b0 in nxt_h1p_request_body_read nxt_h1proto.c:998 #8 0x1023f5c48 in nxt_event_engine_start nxt_event_engine.c:542 #9 0x1023e2838 in nxt_thread_trampoline nxt_thread.c:126 #10 0x18133e030 in _pthread_start+0x84 (libsystem_pthread.dylib:arm64e+0x7030) #11 0x181338e38 in thread_start+0x4 (libsystem_pthread.dylib:arm64e+0x1e38) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/nxt_http_js.c:169:52 Same fix was introduced in NJS: <http://hg.nginx.org/njs/rev/4fba78789fe4> Reviewed-by: Andrew Clayton <[email protected]>
1 parent 0d99744 commit fdc4675

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

src/nxt_http_js.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@ static njs_int_t
162162
nxt_http_js_ext_get_args(njs_vm_t *vm, njs_object_prop_t *prop,
163163
njs_value_t *value, njs_value_t *setval, njs_value_t *retval)
164164
{
165+
u_char *start;
165166
njs_int_t ret;
166167
njs_value_t *args;
167168
njs_opaque_value_t val;
@@ -175,8 +176,8 @@ nxt_http_js_ext_get_args(njs_vm_t *vm, njs_object_prop_t *prop,
175176

176177
args = njs_value_arg(&val);
177178

178-
ret = njs_vm_query_string_parse(vm, r->args->start,
179-
r->args->start + r->args->length, args);
179+
start = (r->args->start != NULL) ? r->args->start : (u_char *) "";
180+
ret = njs_vm_query_string_parse(vm, start, start + r->args->length, args);
180181

181182
if (ret == NJS_ERROR) {
182183
return NJS_ERROR;

0 commit comments

Comments
 (0)