Fixed some issues found by tests with enabled UndefinedBehaviorSanitizer #1109

andrey-zelenkov · 2024-01-31T15:35:19Z

No description provided.

src/nxt_http_js.c

ac000 · 2024-01-31T16:55:43Z

For 505e879 ("Fixed undefined behaviour in left shift of int value")

Reviewed-by: Andrew Clayton <a.clayton@nginx.com>

ac000

EDIT: See below comment...

~~Are you saying that if mmaps->size == 0 then mmaps->elts is NULL?~~

If so, I'd make the check (mmaps->elts == NULL)

src/nxt_port_memory.c

ac000 · 2024-01-31T19:59:02Z

For e059674 ("Initialize port_impl only when it is needed")

Reviewed-by: Andrew Clayton <a.clayton@nginx.com>

ac000 · 2024-01-31T20:19:35Z

src/nxt_http_request.c

+    if (nxt_slow_path(r->args->length == 0)) {
+        r->args_decoded.length = 0;
+        goto end;
+    }
+
    start = r->args->start;
    end = start + r->args->length;



Again, if this is because r->args->start can be NULL, then I'd check for that.

This results in less code, and as @ac000 says, is more clear about why we're doing that:

start = r->args->start ?: (u_char) "";

We'll short circuit out the for () loop the only question is do we want to (or not) do the bit of code between the for () loop and the end label in such situations?

Short circuiting optimizes for the case where .length == 0, at the cost of adding some more code (possibly pessimizing the rest of the cases by one op or so, and also (subjectively) pessimizing readability). I guess it depends on how likely each of the cases are.

Sorry I wasn't clear, the short circuiting is fine. But by not just going to end: when ->start is NULL means we'll execute some other stuff that we may not want to...

Looking closer, assuming the dst = dst_start in the for loop initialiser happens, then we will execute

r->args_decoded.length = dst - r->args_decoded.start;

Which will equate to dst - dst which should be 0 and

if (name_length != 0 || dst != dst_start) {

wil equate to false. So I think those are OK.

So yes, the ternary should also do the trick...

Again, if this is because r->args->start can be NULL, then I'd check for that.

It can.

For example:

/foo: r->args->start is NULL /foo?: r->args->start is not NULL

And for the configuration:

{ "match": { "query": "" } }

The pattern related to query is also NULL.

pattern->start = NULL;

So it looks like we don't need to touch r->args_decoded if there is no UB reported. Otherwise, not sure if we'll have to rethink the parrten->start to query "" value.

I'd would suggest fixing the case of r->args_start is NULL. For example:

if (nxt_slow_path(r->args->start == NULL)) { goto end; }

This reminds me of https://github.com/mkirchner/linked-list-good-taste.

Heh, I actually have that email from Linus saved off for whenever I need to refer to it...

I think what Alex is saying is that with his ternary suggestion the code just flows through and does the right thing ragardless if r->args->start is NULL or not.

Sure, it's the intention of the current code.
The fixing is to make the tool that reported UB happy.

I'd go with Alex's suggestion and fix it like you did in NJS: avoiding arithmetic ops with NULL pointer in r->args

src/nxt_http_route.c

src/nxt_unit.c

andrey-zelenkov · 2024-02-09T19:55:01Z

Replaced length vs 0 checks by string vs NULL where requested.

% git range-diff eabd7c7c...ca37cf1a
 -:  -------- >  1:  ecd57392 Configuration: Add nxt_conf_get_string_dup()
 -:  -------- >  2:  bb376c68 Simplify, by calling nxt_conf_get_string_dup()
 -:  -------- >  3:  46cef09f Configuration: Don't corrupt abstract socket names
 -:  -------- >  4:  9e986704 Configuration: Fix validation of "processes"
 1:  c9f59f4d =  5:  2a2e2bbb Router: match when pattern and tested string are both zero length
 2:  a51f44ad !  6:  3519c47f NJS: avoiding arithmetic ops with NULL pointer in r->args
    @@ Commit message
         SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/nxt_http_js.c:169:52
     
         Same fix was introduced in NJS:
    -    http://hg.nginx.org/njs/rev/4fba78789fe4
    +    <http://hg.nginx.org/njs/rev/4fba78789fe4>
     
      ## src/nxt_http_js.c ##
     @@ src/nxt_http_js.c: static njs_int_t
    @@ src/nxt_http_js.c: static njs_int_t
          njs_value_t *value, njs_value_t *setval, njs_value_t *retval)
      {
     +    u_char              *start;
    -+    uint8_t             length;
          njs_int_t           ret;
          njs_value_t         *args;
          njs_opaque_value_t  val;
    @@ src/nxt_http_js.c: nxt_http_js_ext_get_args(njs_vm_t *vm, njs_object_prop_t *pro
      
     -    ret = njs_vm_query_string_parse(vm, r->args->start,
     -                                    r->args->start + r->args->length, args);
    -+    length = r->args->length;
    -+    start = (length != 0) ? r->args->start : (u_char *) "";
    -+    ret = njs_vm_query_string_parse(vm, start, start + length, args);
    ++    start = (r->args->start != NULL) ? r->args->start : (u_char *) "";
    ++    ret = njs_vm_query_string_parse(vm, start, start + r->args->length, args);
      
          if (ret == NJS_ERROR) {
              return NJS_ERROR;
 3:  505e879f =  7:  890ba34b Fixed undefined behaviour in left shift of int value
 4:  fb6725f6 !  8:  88a17771 Avoiding arithmetic ops with NULL pointer in nxt_http_arguments_parse
    @@ Commit message
     
      ## src/nxt_http_request.c ##
     @@ src/nxt_http_request.c: nxt_http_arguments_parse(nxt_http_request_t *r)
    +         return NULL;
    +     }
      
    -     r->args_decoded.start = dst_start;
    - 
    -+    if (nxt_slow_path(r->args->length == 0)) {
    -+        r->args_decoded.length = 0;
    ++    if (nxt_slow_path(r->args->start == NULL)) {
     +        goto end;
     +    }
     +
    -     start = r->args->start;
    -     end = start + r->args->length;
    - 
    +     hash = NXT_HTTP_FIELD_HASH_INIT;
    +     name = NULL;
    +     name_length = 0;
     @@ src/nxt_http_request.c: nxt_http_arguments_parse(nxt_http_request_t *r)
              }
          }
 5:  54235875 !  9:  540257e4 Avoiding arithmetic ops with NULL pointer in nxt_port_mmap_get
    @@ src/nxt_port_memory.c: nxt_port_mmap_get(nxt_task_t *task, nxt_port_mmaps_t *mma
      
          nxt_thread_mutex_lock(&mmaps->mutex);
      
    -+    if (nxt_slow_path(mmaps->size == 0)) {
    ++    if (nxt_slow_path(mmaps->elts == NULL)) {
     +        goto end;
     +    }
     +
 6:  e0596744 = 10:  4fc83cb7 Initialize port_impl only when it is needed
 7:  eabd7c7c <  -:  -------- Avoiding arithmetic ops with NULL pointer in nxt_unit_mmap_get
 -:  -------- > 11:  ca37cf1a Avoiding arithmetic ops with NULL pointer in nxt_unit_mmap_get

ac000 · 2024-02-20T14:12:29Z

If you could add my Reviewed-by tags to the commits I've specified, then I can more easily see which things I've already reviewed.

andrey-zelenkov · 2024-02-21T15:06:05Z

Rebased and added Reviewed-by: Andrew Clayton <a.clayton@nginx.com> where needed. Was not sure about review status of 27b51c8 so preferred to leave it unreviewed.

% git range-diff ca37cf1a...da0802eb
 ...
 1:  2a2e2bbb = 41:  27b51c8d Router: match when pattern and tested string are both zero length
 2:  3519c47f = 42:  58ef7c74 NJS: avoiding arithmetic ops with NULL pointer in r->args
 3:  890ba34b ! 43:  b706f9a0 Fixed undefined behaviour in left shift of int value
    @@ Commit message
     
         SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/nxt_random.c:151:31
     
    +    Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
    +
      ## src/nxt_random.c ##
     @@ src/nxt_random.c: nxt_random(nxt_random_t *r)
              nxt_random_stir(r);
 4:  88a17771 = 44:  6ae05623 Avoiding arithmetic ops with NULL pointer in nxt_http_arguments_parse
 5:  540257e4 = 45:  c104472d Avoiding arithmetic ops with NULL pointer in nxt_port_mmap_get
 6:  4fc83cb7 ! 46:  2d16d02a Initialize port_impl only when it is needed
    @@ Commit message
     
         Found by UndefinedBehaviorSanitizer.
     
    +    Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
    +
      ## src/nxt_unit.c ##
     @@ src/nxt_unit.c: nxt_unit_request_check_response_port(nxt_unit_request_info_t *req,
          pthread_mutex_lock(&lib->mutex);
 7:  ca37cf1a = 47:  da0802eb Avoiding arithmetic ops with NULL pointer in nxt_unit_mmap_get

src/nxt_http_js.c

src/nxt_unit.c

andrey-zelenkov · 2024-02-22T12:11:11Z

Rebased, two more Reviewed-by, check against NULL in ec5a29a:

% git range-diff da0802eb...b82297c4
 -:  -------- >  1:  bca44630 .mailmap: Map Dylan's GitHub address
 -:  -------- >  2:  f2e64475 Wasm-wc: Register a new Wasm component model language module type
 -:  -------- >  3:  f0782722 Wasm-wc: Add core configuration data structure
 -:  -------- >  4:  20ada4b5 Wasm-wc: Core of initial Wasm component model language module support
 -:  -------- >  5:  a9345dd4 Add a .rustfmt.toml file
 -:  -------- >  6:  79c81772 Wasm-wc: Run src/lib.rs through rustfmt
 -:  -------- >  7:  ac3a54d6 Wasm-wc: Improve request buffer handling
 -:  -------- >  8:  98f808af Wasm-wc: Upgrade to wasmtime 17
 -:  -------- >  9:  60eb6c43 Wasm-wc: Allow to use the 'reactor' adaptor again
 -:  -------- > 10:  8d030139 Wasm-wc: Add Cargo.lock
 -:  -------- > 11:  07a0c9a3 Wasm-wc: Wire up the language module to the config system
 -:  -------- > 12:  da44dc00 Fix alignment of wasm options text in auto/help
 -:  -------- > 13:  4e6d7e87 Wasm-wc: Wire it up to the build system
 -:  -------- > 14:  7702293d Docker: Bump rust version to 1.76.0
 -:  -------- > 15:  1297f6f0 Docker: Add wasm-wasi-component to the wasm target
 -:  -------- > 16:  4c558697 Docker: Re-generate Dockerfile.wasm
 -:  -------- > 17:  7883acc6 Tests: Ruby hook tests unstable for version older 3.0
 -:  -------- > 18:  99da2f3c Tests: check for the AddressSanitizer flag during discovery
 -:  -------- > 19:  dbd9d25f Tests: skip some of TLS reconfiguration tests under AddressSanitizer
 -:  -------- > 20:  cabea47d Tests: renamed test_python_procman.py since it's not Python-specific
 -:  -------- > 21:  3f805bc6 Packages: added wasm-wasi-component module packaging for deb-based distros
 -:  -------- > 22:  7a640556 Packages: added wasm-wasi-component module packaging for rpm-based distros
 -:  -------- > 23:  7b13c306 Wasm-wc: Add nxt_unit.o as a dependency in the auto script
 -:  -------- > 24:  d54af163 Wasm-wc: Use the cargo build output as the make target dependency
 -:  -------- > 25:  2f3c7c2c Update third-party java components to their r -:  -------- > 20:  cabea47d Tests: renamed test_python_procman.py since i
t's not Python-specific
 -:  -------- > 21:  3f805bc6 Packages: added wasm-wasi-component module pa
ckaging for deb-based distros
 -:  -------- > 18:  99da2f3c Tests: check for the AddressSanitizer flag du
ring discovery
 -:  -------- > 19:  dbd9d25f Tests: skip some of TLS reconfiguration tests
 under AddressSanitizer
 -:  -------- > 20:  cabea47d Tests: renamed test_python_procman.py since i
t's not Python-specific
 -:  -------- > 21:  3f805bc6 Packages: added wasm-wasi-component module pa
ckaging for deb-based distros
 -:  -------- > 22:  7a640556 Packages: added wasm-wasi-component module pa
ckaging for rpm-based distros
 -:  -------- > 23:  7b13c306 Wasm-wc: Add nxt_unit.o as a dependency in th
e auto script
 -:  -------- > 24:  d54af163 Wasm-wc: Use the cargo build output as the ma
ke target dependency
 -:  -------- > 25:  2f3c7c2c Update third-party java components to their r
ecent versions
 1:  27b51c8d ! 26:  ec5a29a1 Router: match when pattern and tested string are both zero length
    @@ src/nxt_http_route.c: nxt_http_route_pattern(nxt_http_request_t *r, nxt_http_rou
              return 0;
          }
      
    -+    if (nxt_slow_path(length == 0)) {
    ++    if (nxt_slow_path(start == NULL)) {
     +        return 1;
     +    }
     +
 2:  58ef7c74 ! 27:  65a80df6 NJS: avoiding arithmetic ops with NULL pointer in r->args
    @@ Commit message
         Same fix was introduced in NJS:
         <http://hg.nginx.org/njs/rev/4fba78789fe4>
     
    +    Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
    +
      ## src/nxt_http_js.c ##
     @@ src/nxt_http_js.c: static njs_int_t
      nxt_http_js_ext_get_args(njs_vm_t *vm, njs_object_prop_t *prop,
 3:  b706f9a0 = 28:  658d5c0a Fixed undefined behaviour in left shift of int value
 4:  6ae05623 = 29:  589b50c1 Avoiding arithmetic ops with NULL pointer in nxt_http_arguments_parse
 5:  c104472d = 30:  7d10bd59 Avoiding arithmetic ops with NULL pointer in nxt_port_mmap_get
 6:  2d16d02a = 31:  4f374c45 Initialize port_impl only when it is needed
 7:  da0802eb ! 32:  b82297c4 Avoiding arithmetic ops with NULL pointer in nxt_unit_mmap_get
    @@ Commit message
     
         Found by UndefinedBehaviorSanitizer.
     
    +    Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
    +
      ## src/nxt_unit.c ##
     @@ src/nxt_unit.c: nxt_unit_mmap_get(nxt_unit_ctx_t *ctx, nxt_unit_port_t *port,

src/nxt_http_route.c

src/nxt_port_memory.c

andrey-zelenkov · 2024-02-22T18:34:13Z

% git range-diff b82297c4...8eb3653f
1:  ec5a29a1 ! 1:  f80edc37 Router: match when pattern and tested string are both zero length
    @@ Commit message
     
         SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/nxt_http_route.c:2141:17
     
    +    Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
    +
      ## src/nxt_http_route.c ##
     @@ src/nxt_http_route.c: nxt_http_route_pattern(nxt_http_request_t *r, nxt_http_route_pattern_t *pattern,
              return 0;
2:  65a80df6 = 2:  592fe518 NJS: avoiding arithmetic ops with NULL pointer in r->args
3:  658d5c0a = 3:  915fd982 Fixed undefined behaviour in left shift of int value
4:  589b50c1 = 4:  1dafe541 Avoiding arithmetic ops with NULL pointer in nxt_http_arguments_parse
5:  7d10bd59 ! 5:  213864c3 Avoiding arithmetic ops with NULL pointer in nxt_port_mmap_get
    @@ Commit message
         Can be reproduced by test/test_settings.py::test_settings_send_timeout
         with enabled UndefinedBehaviorSanitizer.
     
    +    Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
    +
      ## src/nxt_port_memory.c ##
     @@ src/nxt_port_memory.c: nxt_port_mmap_get(nxt_task_t *task, nxt_port_mmaps_t *mmaps, nxt_chunk_id_t *c,
      
6:  4f374c45 = 6:  e6571b8e Initialize port_impl only when it is needed
7:  b82297c4 = 7:  8eb3653f Avoiding arithmetic ops with NULL pointer in nxt_unit_mmap_get

src/nxt_http_request.c

Otherwise, undefined behaviour will be triggered. Can be reproduced by test/test_routing.py::test_routes_match_host_empty with enabled UndefinedBehaviorSanitizer: src/nxt_http_route.c:2141:17: runtime error: applying zero offset to null pointer #0 0x100562588 in nxt_http_route_test_rule nxt_http_route.c:2091 nginx#1 0x100564ed8 in nxt_http_route_handler nxt_http_route.c:1574 nginx#2 0x10055188c in nxt_http_request_action nxt_http_request.c:570 nginx#3 0x10052b1a0 in nxt_h1p_request_body_read nxt_h1proto.c:998 nginx#4 0x100449c38 in nxt_event_engine_start nxt_event_engine.c:542 nginx#5 0x100436828 in nxt_thread_trampoline nxt_thread.c:126 nginx#6 0x18133e030 in _pthread_start+0x84 (libsystem_pthread.dylib:arm64e+0x7030) nginx#7 0x181338e38 in thread_start+0x4 (libsystem_pthread.dylib:arm64e+0x1e38) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/nxt_http_route.c:2141:17 Reviewed-by: Andrew Clayton <a.clayton@nginx.com>

Can be reproduced by test/test_rewrite.py::test_rewrite_njs with enabled UndefinedBehaviorSanitizer: src/nxt_http_js.c:169:52: runtime error: applying zero offset to null pointer #0 0x10255b044 in nxt_http_js_ext_get_args nxt_http_js.c:169 nginx#1 0x102598ad0 in njs_value_property njs_value.c:1175 nginx#2 0x10259c2c8 in njs_vm_object_prop njs_vm.c:1398 nginx#3 0x102559d74 in nxt_js_call nxt_js.c:445 nginx#4 0x1023c0da0 in nxt_tstr_query nxt_tstr.c:276 nginx#5 0x102516ec4 in nxt_http_rewrite nxt_http_rewrite.c:56 nginx#6 0x1024fd86c in nxt_http_request_action nxt_http_request.c:565 nginx#7 0x1024d71b0 in nxt_h1p_request_body_read nxt_h1proto.c:998 nginx#8 0x1023f5c48 in nxt_event_engine_start nxt_event_engine.c:542 nginx#9 0x1023e2838 in nxt_thread_trampoline nxt_thread.c:126 nginx#10 0x18133e030 in _pthread_start+0x84 (libsystem_pthread.dylib:arm64e+0x7030) nginx#11 0x181338e38 in thread_start+0x4 (libsystem_pthread.dylib:arm64e+0x1e38) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/nxt_http_js.c:169:52 Same fix was introduced in NJS: <http://hg.nginx.org/njs/rev/4fba78789fe4> Reviewed-by: Andrew Clayton <a.clayton@nginx.com>

Found by UndefinedBehaviorSanitizer: src/nxt_random.c:151:31: runtime error: left shift of 140 by 24 places cannot be represented in type 'int' #0 0x104f78968 in nxt_random nxt_random.c:151 nginx#1 0x104f58a98 in nxt_shm_open nxt_port_memory.c:377 nginx#2 0x10503e24c in nxt_controller_conf_send nxt_controller.c:617 nginx#3 0x105041154 in nxt_controller_process_request nxt_controller.c:1109 nginx#4 0x104fcdc48 in nxt_event_engine_start nxt_event_engine.c:542 nginx#5 0x104f27254 in main nxt_main.c:35 nginx#6 0x180fbd0dc (<unknown module>) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/nxt_random.c:151:31 Reviewed-by: Andrew Clayton <a.clayton@nginx.com>

Can be reproduced by test/test_variables.py::test_variables_dynamic_arguments with enabled UndefinedBehaviorSanitizer: src/nxt_http_request.c:961:17: runtime error: applying zero offset to null pointer #0 0x1050d95a4 in nxt_http_arguments_parse nxt_http_request.c:961 nginx#1 0x105102bf8 in nxt_http_var_arg nxt_http_variables.c:621 nginx#2 0x104f95d74 in nxt_var_interpreter nxt_var.c:507 nginx#3 0x104f98c98 in nxt_tstr_query nxt_tstr.c:265 nginx#4 0x1050abfd8 in nxt_router_access_log_writer nxt_router_access_log.c:194 nginx#5 0x1050d81f4 in nxt_http_request_close_handler nxt_http_request.c:838 nginx#6 0x104fcdc48 in nxt_event_engine_start nxt_event_engine.c:542 nginx#7 0x104fba838 in nxt_thread_trampoline nxt_thread.c:126 nginx#8 0x18133e030 in _pthread_start+0x84 (libsystem_pthread.dylib:arm64e+0x7030) nginx#9 0x181338e38 in thread_start+0x4 (libsystem_pthread.dylib:arm64e+0x1e38) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/nxt_http_request.c:961:17 Reviewed-by: Andrew Clayton <a.clayton@nginx.com>

Can be reproduced by test/test_settings.py::test_settings_send_timeout with enabled UndefinedBehaviorSanitizer. Reviewed-by: Andrew Clayton <a.clayton@nginx.com>

Found by UndefinedBehaviorSanitizer. Reviewed-by: Andrew Clayton <a.clayton@nginx.com>

andrey-zelenkov · 2024-02-23T15:33:29Z

% git range-diff 8eb3653f...887fa467
 -:  -------- >  1:  e2cab032 Remove debug from builds and tests
 -:  -------- >  2:  faa7e792 Packages: Pass CFLAGS to compile wasm modules on all packaging targets
 1:  f80edc37 =  3:  2dfba775 Router: match when pattern and tested string are both zero length
 2:  592fe518 =  4:  edb69d54 NJS: avoiding arithmetic ops with NULL pointer in r->args
 3:  915fd982 =  5:  e9c12c21 Fixed undefined behaviour in left shift of int value
 4:  1dafe541 !  6:  5eeaf1f8 Avoiding arithmetic ops with NULL pointer in nxt_http_arguments_parse
    @@ Commit message
     
         SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/nxt_http_request.c:961:17
     
    +    Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
    +
      ## src/nxt_http_request.c ##
     @@ src/nxt_http_request.c: nxt_http_arguments_parse(nxt_http_request_t *r)
              return NULL;
 5:  213864c3 =  7:  e14f64b3 Avoiding arithmetic ops with NULL pointer in nxt_port_mmap_get
 6:  e6571b8e =  8:  3431dfea Initialize port_impl only when it is needed
 7:  8eb3653f =  9:  887fa467 Avoiding arithmetic ops with NULL pointer in nxt_unit_mmap_get

src/nxt_http_route.c

hongzhidao · 2024-02-05T07:36:25Z

src/nxt_http_js.c

@@ -152,6 +152,8 @@ static njs_int_t
 nxt_http_js_ext_get_args(njs_vm_t *vm, njs_object_prop_t *prop,
    njs_value_t *value, njs_value_t *setval, njs_value_t *retval)
 {
+    u_char              *start;
+    uint8_t             length;


Maybe size_t is better.

src/nxt_http_js.c

hongzhidao · 2024-02-05T15:38:45Z

src/nxt_http_request.c

+    if (nxt_slow_path(r->args->length == 0)) {
+        r->args_decoded.length = 0;
+        goto end;
+    }
+
    start = r->args->start;
    end = start + r->args->length;



Sure, it's the intention of the current code.
The fixing is to make the tool that reported UB happy.

andrey-zelenkov requested review from ac000 and hongzhidao January 31, 2024 15:35

ac000 reviewed Jan 31, 2024

View reviewed changes

src/nxt_http_js.c Outdated Show resolved Hide resolved

ac000 reviewed Jan 31, 2024

View reviewed changes

src/nxt_port_memory.c Outdated Show resolved Hide resolved

ac000 reviewed Jan 31, 2024

View reviewed changes

src/nxt_http_route.c Outdated Show resolved Hide resolved

ac000 reviewed Jan 31, 2024

View reviewed changes

src/nxt_unit.c Outdated Show resolved Hide resolved

andrey-zelenkov force-pushed the ubsan_fixes branch from eabd7c7 to ca37cf1 Compare February 9, 2024 19:51

andrey-zelenkov force-pushed the ubsan_fixes branch from ca37cf1 to da0802e Compare February 21, 2024 15:02

ac000 reviewed Feb 21, 2024

View reviewed changes

src/nxt_http_js.c Show resolved Hide resolved

ac000 reviewed Feb 21, 2024

View reviewed changes

src/nxt_unit.c Show resolved Hide resolved

andrey-zelenkov force-pushed the ubsan_fixes branch from da0802e to b82297c Compare February 22, 2024 12:09

ac000 reviewed Feb 22, 2024

View reviewed changes

src/nxt_http_route.c Show resolved Hide resolved

ac000 reviewed Feb 22, 2024

View reviewed changes

src/nxt_port_memory.c Show resolved Hide resolved

andrey-zelenkov force-pushed the ubsan_fixes branch from b82297c to 8eb3653 Compare February 22, 2024 18:33

ac000 reviewed Feb 23, 2024

View reviewed changes

src/nxt_http_request.c Show resolved Hide resolved

andrey-zelenkov added 6 commits February 23, 2024 15:24

Avoiding arithmetic ops with NULL pointer in nxt_port_mmap_get

e14f64b

Can be reproduced by test/test_settings.py::test_settings_send_timeout with enabled UndefinedBehaviorSanitizer. Reviewed-by: Andrew Clayton <a.clayton@nginx.com>

Initialize port_impl only when it is needed

3431dfe

Found by UndefinedBehaviorSanitizer. Reviewed-by: Andrew Clayton <a.clayton@nginx.com>

Avoiding arithmetic ops with NULL pointer in nxt_unit_mmap_get

887fa46

Found by UndefinedBehaviorSanitizer. Reviewed-by: Andrew Clayton <a.clayton@nginx.com>

andrey-zelenkov force-pushed the ubsan_fixes branch from 8eb3653 to 887fa46 Compare February 23, 2024 15:32

ac000 approved these changes Feb 23, 2024

View reviewed changes

hongzhidao approved these changes Feb 29, 2024

View reviewed changes

andrey-zelenkov merged commit dd701fb into nginx:master Mar 11, 2024
15 checks passed

andrey-zelenkov deleted the ubsan_fixes branch March 22, 2024 01:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixed some issues found by tests with enabled UndefinedBehaviorSanitizer #1109

Fixed some issues found by tests with enabled UndefinedBehaviorSanitizer #1109

andrey-zelenkov commented Jan 31, 2024

ac000 commented Jan 31, 2024

ac000 left a comment •

edited

Loading

ac000 commented Jan 31, 2024

ac000 Jan 31, 2024

alejandro-colomar Feb 3, 2024 •

edited

Loading

ac000 Feb 3, 2024

alejandro-colomar Feb 3, 2024 •

edited

Loading

ac000 Feb 3, 2024

hongzhidao Feb 5, 2024 •

edited

Loading

alejandro-colomar Feb 5, 2024

ac000 Feb 5, 2024

hongzhidao Feb 5, 2024

ac000 Feb 21, 2024

andrey-zelenkov commented Feb 9, 2024 •

edited

Loading

ac000 commented Feb 20, 2024

andrey-zelenkov commented Feb 21, 2024

andrey-zelenkov commented Feb 22, 2024

andrey-zelenkov commented Feb 22, 2024

andrey-zelenkov commented Feb 23, 2024

hongzhidao Feb 5, 2024

hongzhidao Feb 5, 2024

Fixed some issues found by tests with enabled UndefinedBehaviorSanitizer #1109

Fixed some issues found by tests with enabled UndefinedBehaviorSanitizer #1109

Conversation

andrey-zelenkov commented Jan 31, 2024

ac000 commented Jan 31, 2024

ac000 left a comment • edited Loading

Choose a reason for hiding this comment

ac000 commented Jan 31, 2024

Choose a reason for hiding this comment

alejandro-colomar Feb 3, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alejandro-colomar Feb 3, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hongzhidao Feb 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andrey-zelenkov commented Feb 9, 2024 • edited Loading

ac000 commented Feb 20, 2024

andrey-zelenkov commented Feb 21, 2024

andrey-zelenkov commented Feb 22, 2024

andrey-zelenkov commented Feb 22, 2024

andrey-zelenkov commented Feb 23, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ac000 left a comment •

edited

Loading

alejandro-colomar Feb 3, 2024 •

edited

Loading

alejandro-colomar Feb 3, 2024 •

edited

Loading

hongzhidao Feb 5, 2024 •

edited

Loading

andrey-zelenkov commented Feb 9, 2024 •

edited

Loading