diff options
| author | Valentin Bartenev <vbart@nginx.com> | 2021-11-23 15:36:24 +0300 |
|---|---|---|
| committer | Valentin Bartenev <vbart@nginx.com> | 2021-11-23 15:36:24 +0300 |
| commit | ef1ebf96f300d9a2f487656ac827a9c166f57197 (patch) | |
| tree | 69b72111f8b4b8d733f25d1f1fbe61b090fbeb3d | |
| parent | 015610f12d915d0ac28498bbd871ad5c67fd9b24 (diff) | |
| download | unit-ef1ebf96f300d9a2f487656ac827a9c166f57197.tar.gz unit-ef1ebf96f300d9a2f487656ac827a9c166f57197.tar.bz2 | |
Fixed possible access to an uninitialized field.
The "recv_msg.incoming_buf" is checked after jumping to the "done" label
if nxt_socket_msg_oob_get_fds() returns an error.
Also moved initialization of "port_msg" near to its first usage.
Found by Coverity (CID 373899).
Diffstat (limited to '')
| -rw-r--r-- | src/nxt_unit.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/nxt_unit.c b/src/nxt_unit.c index 06ad1636..135c06ed 100644 --- a/src/nxt_unit.c +++ b/src/nxt_unit.c @@ -937,9 +937,9 @@ nxt_unit_process_msg(nxt_unit_ctx_t *ctx, nxt_unit_read_buf_t *rbuf, lib = nxt_container_of(ctx->unit, nxt_unit_impl_t, unit); + recv_msg.incoming_buf = NULL; recv_msg.fd[0] = -1; recv_msg.fd[1] = -1; - port_msg = (nxt_port_msg_t *) rbuf->buf; rc = nxt_socket_msg_oob_get_fds(&rbuf->oob, recv_msg.fd); if (nxt_slow_path(rc != NXT_OK)) { @@ -948,8 +948,6 @@ nxt_unit_process_msg(nxt_unit_ctx_t *ctx, nxt_unit_read_buf_t *rbuf, goto done; } - recv_msg.incoming_buf = NULL; - if (nxt_slow_path(rbuf->size < (ssize_t) sizeof(nxt_port_msg_t))) { if (nxt_slow_path(rbuf->size == 0)) { nxt_unit_debug(ctx, "read port closed"); @@ -965,6 +963,8 @@ nxt_unit_process_msg(nxt_unit_ctx_t *ctx, nxt_unit_read_buf_t *rbuf, goto done; } + port_msg = (nxt_port_msg_t *) rbuf->buf; + nxt_unit_debug(ctx, "#%"PRIu32": process message %d fd[0] %d fd[1] %d", port_msg->stream, (int) port_msg->type, recv_msg.fd[0], recv_msg.fd[1]); |