From fa81d7a11a7ba31ddded934eac8e58e7c801d44a Mon Sep 17 00:00:00 2001 From: Andrew Clayton Date: Tue, 28 Feb 2023 15:41:53 +0000 Subject: Perl: Fix a crash in the language module. User @bes-internal reported a Perl module crasher on GitHub. This was due to a Perl application sending back two responses, for each response we would call down into XS_NGINX__Unit__Sandbox_cb(), the first time pctx->req would point to a valid nxt_unit_request_info_t, the second time pctx->req would be NULL. Add an invalid responses check which covers this case. Closes: Reviewed-by: Alejandro Colomar Signed-off-by: Andrew Clayton --- src/perl/nxt_perl_psgi.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/perl/nxt_perl_psgi.c b/src/perl/nxt_perl_psgi.c index 5e8d1aee..807d1741 100644 --- a/src/perl/nxt_perl_psgi.c +++ b/src/perl/nxt_perl_psgi.c @@ -267,8 +267,11 @@ XS(XS_NGINX__Unit__Sandbox_cb) XSRETURN_EMPTY; } + pctx = CvXSUBANY(cv).any_ptr; + if (nxt_slow_path(SvOK(ST(0)) == 0 || SvROK(ST(0)) == 0 - || SvTYPE(SvRV(ST(0))) != SVt_PVAV)) + || SvTYPE(SvRV(ST(0))) != SVt_PVAV + || pctx->req == NULL)) { nxt_perl_psgi_cb_request_done(CvXSUBANY(cv).any_ptr, NXT_UNIT_ERROR); @@ -278,8 +281,6 @@ XS(XS_NGINX__Unit__Sandbox_cb) XSRETURN_EMPTY; } - pctx = CvXSUBANY(cv).any_ptr; - rc = nxt_perl_psgi_result_array(PERL_GET_CONTEXT, ST(0), pctx->req); if (nxt_slow_path(rc != NXT_UNIT_OK)) { nxt_perl_psgi_cb_request_done(CvXSUBANY(cv).any_ptr, NXT_UNIT_ERROR); -- cgit