Skip to content

Commit

Permalink
fix(build): patch ngx_lua-1.21.4_07-print-body-double-free bug fix (#…
Browse files Browse the repository at this point in the history
…10816)

(cherry picked from commit 4dd3a34)
  • Loading branch information
oowl authored and locao committed Jun 2, 2023
1 parent 352283c commit 7303ea3
Show file tree
Hide file tree
Showing 2 changed files with 63 additions and 0 deletions.
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
diff --git a/bundle/ngx_lua-0.10.21/src/ngx_http_lua_bodyfilterby.c b/bundle/ngx_lua-0.10.21/src/ngx_http_lua_bodyfilterby.c
index 9024889..604702c 100644
--- a/bundle/ngx_lua-0.10.21/src/ngx_http_lua_bodyfilterby.c
+++ b/bundle/ngx_lua-0.10.21/src/ngx_http_lua_bodyfilterby.c
@@ -298,7 +298,7 @@ ngx_http_lua_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
out = NULL;
ngx_chain_update_chains(r->pool,
&ctx->free_bufs, &ctx->filter_busy_bufs, &out,
- (ngx_buf_tag_t) &ngx_http_lua_module);
+ (ngx_buf_tag_t) &ngx_http_lua_body_filter);
if (rc != NGX_OK
&& ctx->filter_busy_bufs != NULL
&& (r->connection->buffered
@@ -377,7 +377,7 @@ ngx_http_lua_body_filter(ngx_http_request_t *r, ngx_chain_t *in)

ngx_chain_update_chains(r->pool,
&ctx->free_bufs, &ctx->filter_busy_bufs, &out,
- (ngx_buf_tag_t) &ngx_http_lua_module);
+ (ngx_buf_tag_t) &ngx_http_lua_body_filter);

return rc;
}
@@ -640,6 +640,7 @@ ngx_http_lua_body_filter_param_set(lua_State *L, ngx_http_request_t *r,
return luaL_error(L, "no memory");
}

+ cl->buf->tag = (ngx_buf_tag_t) &ngx_http_lua_body_filter;
if (type == LUA_TTABLE) {
cl->buf->last = ngx_http_lua_copy_str_in_table(L, 3, cl->buf->last);

@@ -657,6 +658,8 @@ done:
if (cl == NULL) {
return luaL_error(L, "no memory");
}
+
+ cl->buf->tag = (ngx_buf_tag_t) &ngx_http_lua_body_filter;
}

if (last) {
24 changes: 24 additions & 0 deletions t/04-patch/01-ngx-buf-double-free.t
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# vim:set ft= ts=4 sw=4 et fdm=marker:

use Test::Nginx::Socket 'no_plan';

repeat_each(2);

run_tests();

__DATA__
=== TEST 1: one buf was linked to multiple ngx_chain_t nodes
--- config
location /t {
content_by_lua_block {
local str = string.rep(".", 1300)
ngx.print(str)
ngx.flush()
ngx.print("small chunk")
ngx.flush()
}
body_filter_by_lua_block {local dummy=1}
}
--- request
GET /t
--- response_body_like: small chunk

0 comments on commit 7303ea3

Please sign in to comment.