diff options
| author | Andrew Clayton <a.clayton@nginx.com> | 2023-02-28 15:41:53 +0000 |
|---|---|---|
| committer | Andrew Clayton <a.clayton@nginx.com> | 2023-03-10 21:40:28 +0000 |
| commit | fa81d7a11a7ba31ddded934eac8e58e7c801d44a (patch) | |
| tree | cb1a9649a9fa8ee6976914bfe4cb7beae72af693 /src/perl | |
| parent | 78e1122a3c94a150219b4b6e1e594ae5bfdd8d68 (diff) | |
| download | unit-fa81d7a11a7ba31ddded934eac8e58e7c801d44a.tar.gz unit-fa81d7a11a7ba31ddded934eac8e58e7c801d44a.tar.bz2 | |
Perl: Fix a crash in the language module.
User @bes-internal reported a Perl module crasher on GitHub.
This was due to a Perl application sending back two responses, for each
response we would call down into XS_NGINX__Unit__Sandbox_cb(), the first
time pctx->req would point to a valid nxt_unit_request_info_t, the
second time pctx->req would be NULL.
Add an invalid responses check which covers this case.
Closes: <https://github.com/nginx/unit/issues/841>
Reviewed-by: Alejandro Colomar <alx@nginx.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
Diffstat (limited to 'src/perl')
| -rw-r--r-- | src/perl/nxt_perl_psgi.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/perl/nxt_perl_psgi.c b/src/perl/nxt_perl_psgi.c index 5e8d1aee..807d1741 100644 --- a/src/perl/nxt_perl_psgi.c +++ b/src/perl/nxt_perl_psgi.c @@ -267,8 +267,11 @@ XS(XS_NGINX__Unit__Sandbox_cb) XSRETURN_EMPTY; } + pctx = CvXSUBANY(cv).any_ptr; + if (nxt_slow_path(SvOK(ST(0)) == 0 || SvROK(ST(0)) == 0 - || SvTYPE(SvRV(ST(0))) != SVt_PVAV)) + || SvTYPE(SvRV(ST(0))) != SVt_PVAV + || pctx->req == NULL)) { nxt_perl_psgi_cb_request_done(CvXSUBANY(cv).any_ptr, NXT_UNIT_ERROR); @@ -278,8 +281,6 @@ XS(XS_NGINX__Unit__Sandbox_cb) XSRETURN_EMPTY; } - pctx = CvXSUBANY(cv).any_ptr; - rc = nxt_perl_psgi_result_array(PERL_GET_CONTEXT, ST(0), pctx->req); if (nxt_slow_path(rc != NXT_UNIT_OK)) { nxt_perl_psgi_cb_request_done(CvXSUBANY(cv).any_ptr, NXT_UNIT_ERROR); |