From 7303ea37b589dc4dabf0c54bc40f2e7678e2ed57 Mon Sep 17 00:00:00 2001
From: Jun Ouyang <ouyangjun1999@gmail.com>
Date: Tue, 9 May 2023 16:15:19 +0800
Subject: [PATCH] fix(build): patch ngx_lua-1.21.4_07-print-body-double-free
 bug fix (#10816)

(cherry picked from commit 4dd3a34b70bbb37a5968b3f0ae20ab83446cc5d8)
---
 ...ua-0.10.21_08-print-body-double-free.patch | 39 +++++++++++++++++++
 t/04-patch/01-ngx-buf-double-free.t           | 24 ++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 build/openresty/patches/ngx_lua-0.10.21_08-print-body-double-free.patch
 create mode 100644 t/04-patch/01-ngx-buf-double-free.t

diff --git a/build/openresty/patches/ngx_lua-0.10.21_08-print-body-double-free.patch b/build/openresty/patches/ngx_lua-0.10.21_08-print-body-double-free.patch
new file mode 100644
index 00000000000..ad8ff610863
--- /dev/null
+++ b/build/openresty/patches/ngx_lua-0.10.21_08-print-body-double-free.patch
@@ -0,0 +1,39 @@
+diff --git a/bundle/ngx_lua-0.10.21/src/ngx_http_lua_bodyfilterby.c b/bundle/ngx_lua-0.10.21/src/ngx_http_lua_bodyfilterby.c
+index 9024889..604702c 100644
+--- a/bundle/ngx_lua-0.10.21/src/ngx_http_lua_bodyfilterby.c
++++ b/bundle/ngx_lua-0.10.21/src/ngx_http_lua_bodyfilterby.c
+@@ -298,7 +298,7 @@ ngx_http_lua_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
+         out = NULL;
+         ngx_chain_update_chains(r->pool,
+                                 &ctx->free_bufs, &ctx->filter_busy_bufs, &out,
+-                                (ngx_buf_tag_t) &ngx_http_lua_module);
++                                (ngx_buf_tag_t) &ngx_http_lua_body_filter);
+         if (rc != NGX_OK
+             && ctx->filter_busy_bufs != NULL
+             && (r->connection->buffered
+@@ -377,7 +377,7 @@ ngx_http_lua_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
+ 
+     ngx_chain_update_chains(r->pool,
+                             &ctx->free_bufs, &ctx->filter_busy_bufs, &out,
+-                            (ngx_buf_tag_t) &ngx_http_lua_module);
++                            (ngx_buf_tag_t) &ngx_http_lua_body_filter);
+ 
+     return rc;
+ }
+@@ -640,6 +640,7 @@ ngx_http_lua_body_filter_param_set(lua_State *L, ngx_http_request_t *r,
+         return luaL_error(L, "no memory");
+     }
+ 
++    cl->buf->tag = (ngx_buf_tag_t) &ngx_http_lua_body_filter;
+     if (type == LUA_TTABLE) {
+         cl->buf->last = ngx_http_lua_copy_str_in_table(L, 3, cl->buf->last);
+ 
+@@ -657,6 +658,8 @@ done:
+             if (cl == NULL) {
+                 return luaL_error(L, "no memory");
+             }
++
++            cl->buf->tag = (ngx_buf_tag_t) &ngx_http_lua_body_filter;
+         }
+ 
+         if (last) {
diff --git a/t/04-patch/01-ngx-buf-double-free.t b/t/04-patch/01-ngx-buf-double-free.t
new file mode 100644
index 00000000000..10612e7912e
--- /dev/null
+++ b/t/04-patch/01-ngx-buf-double-free.t
@@ -0,0 +1,24 @@
+# vim:set ft= ts=4 sw=4 et fdm=marker:
+
+use Test::Nginx::Socket 'no_plan';
+
+repeat_each(2);
+
+run_tests();
+
+__DATA__
+=== TEST 1: one buf was linked to multiple ngx_chain_t nodes
+--- config
+    location /t {
+        content_by_lua_block {
+            local str = string.rep(".", 1300)
+            ngx.print(str)
+            ngx.flush()
+            ngx.print("small chunk")
+            ngx.flush()
+        }
+        body_filter_by_lua_block {local dummy=1}
+    }
+--- request
+GET /t
+--- response_body_like: small chunk