From 2f8b243fa466b68eb657119d612075bffeea364e Mon Sep 17 00:00:00 2001 From: Max Romanov Date: Tue, 28 Jan 2020 16:59:12 +0300 Subject: Ruby: changing callback functions prototype for v2.7. This closes #371 issue on GitHub. --- src/ruby/nxt_ruby.c | 6 ++++-- src/ruby/nxt_ruby_stream_io.c | 18 +++++++++--------- 2 files changed, 13 insertions(+), 11 deletions(-) (limited to 'src') diff --git a/src/ruby/nxt_ruby.c b/src/ruby/nxt_ruby.c index e4b30319..417e2d8d 100644 --- a/src/ruby/nxt_ruby.c +++ b/src/ruby/nxt_ruby.c @@ -52,7 +52,8 @@ static int nxt_ruby_hash_info(VALUE r_key, VALUE r_value, VALUE arg); static int nxt_ruby_hash_add(VALUE r_key, VALUE r_value, VALUE arg); static int nxt_ruby_rack_result_body(VALUE result); static int nxt_ruby_rack_result_body_file_write(VALUE filepath); -static VALUE nxt_ruby_rack_result_body_each(VALUE body); +static VALUE nxt_ruby_rack_result_body_each(VALUE body, VALUE arg, + int argc, const VALUE *argv, VALUE blockarg); static void nxt_ruby_exception_log(nxt_task_t *task, uint32_t level, const char *desc); @@ -813,7 +814,8 @@ nxt_ruby_rack_result_body_file_write(VALUE filepath) static VALUE -nxt_ruby_rack_result_body_each(VALUE body) +nxt_ruby_rack_result_body_each(VALUE body, VALUE arg, int argc, + const VALUE *argv, VALUE blockarg) { int rc; diff --git a/src/ruby/nxt_ruby_stream_io.c b/src/ruby/nxt_ruby_stream_io.c index fcfcf5dd..7e8b3ce1 100644 --- a/src/ruby/nxt_ruby_stream_io.c +++ b/src/ruby/nxt_ruby_stream_io.c @@ -10,15 +10,15 @@ static VALUE nxt_ruby_stream_io_new(VALUE class, VALUE wrap); static VALUE nxt_ruby_stream_io_initialize(int argc, VALUE *argv, VALUE self); -static VALUE nxt_ruby_stream_io_gets(VALUE obj, VALUE args); -static VALUE nxt_ruby_stream_io_each(VALUE obj, VALUE args); +static VALUE nxt_ruby_stream_io_gets(VALUE obj); +static VALUE nxt_ruby_stream_io_each(VALUE obj); static VALUE nxt_ruby_stream_io_read(VALUE obj, VALUE args); -static VALUE nxt_ruby_stream_io_rewind(VALUE obj, VALUE args); +static VALUE nxt_ruby_stream_io_rewind(VALUE obj); static VALUE nxt_ruby_stream_io_puts(VALUE obj, VALUE args); static VALUE nxt_ruby_stream_io_write(VALUE obj, VALUE args); nxt_inline long nxt_ruby_stream_io_s_write(nxt_ruby_run_ctx_t *run_ctx, VALUE val); -static VALUE nxt_ruby_stream_io_flush(VALUE obj, VALUE args); +static VALUE nxt_ruby_stream_io_flush(VALUE obj); VALUE @@ -85,7 +85,7 @@ nxt_ruby_stream_io_initialize(int argc, VALUE *argv, VALUE self) static VALUE -nxt_ruby_stream_io_gets(VALUE obj, VALUE args) +nxt_ruby_stream_io_gets(VALUE obj) { VALUE buf; char *p; @@ -132,7 +132,7 @@ nxt_ruby_stream_io_gets(VALUE obj, VALUE args) static VALUE -nxt_ruby_stream_io_each(VALUE obj, VALUE args) +nxt_ruby_stream_io_each(VALUE obj) { VALUE chunk; @@ -141,7 +141,7 @@ nxt_ruby_stream_io_each(VALUE obj, VALUE args) } for ( ;; ) { - chunk = nxt_ruby_stream_io_gets(obj, Qnil); + chunk = nxt_ruby_stream_io_gets(obj); if (chunk == Qnil) { return Qnil; @@ -203,7 +203,7 @@ nxt_ruby_stream_io_read(VALUE obj, VALUE args) static VALUE -nxt_ruby_stream_io_rewind(VALUE obj, VALUE args) +nxt_ruby_stream_io_rewind(VALUE obj) { return Qnil; } @@ -266,7 +266,7 @@ nxt_ruby_stream_io_s_write(nxt_ruby_run_ctx_t *run_ctx, VALUE val) static VALUE -nxt_ruby_stream_io_flush(VALUE obj, VALUE args) +nxt_ruby_stream_io_flush(VALUE obj) { return Qnil; } -- cgit From 1451090d85db4152ba432b45d2e164b4f76bc80c Mon Sep 17 00:00:00 2001 From: Max Romanov Date: Tue, 28 Jan 2020 17:06:57 +0300 Subject: Node.js: suppress compilation warning. --- src/nodejs/unit-http/unit.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src') diff --git a/src/nodejs/unit-http/unit.cpp b/src/nodejs/unit-http/unit.cpp index 1fa73689..64e076c1 100644 --- a/src/nodejs/unit-http/unit.cpp +++ b/src/nodejs/unit-http/unit.cpp @@ -844,7 +844,7 @@ Unit::response_write(napi_env env, napi_callback_info info) res_len = nxt_unit_response_write_nb(req, ptr, have_buf_len, 0); - ret = res_len < 0 ? -res_len : NXT_UNIT_OK; + ret = res_len < 0 ? -res_len : (int) NXT_UNIT_OK; } if (ret != NXT_UNIT_OK) { -- cgit From 4eb2d3086b4abbcbf6c81170bcf7b9ccefd05428 Mon Sep 17 00:00:00 2001 From: Axel Duch Date: Tue, 28 Jan 2020 15:05:12 +0000 Subject: Fixed missing IPv6 checking in route-addr and an unused variable. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This closes #363 issue on Github. Thanks to to 洪志道 (Hong Zhi Dao). --- src/nxt_http_route_addr.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/nxt_http_route_addr.c b/src/nxt_http_route_addr.c index 3c7e9c84..6d4955ed 100644 --- a/src/nxt_http_route_addr.c +++ b/src/nxt_http_route_addr.c @@ -18,7 +18,7 @@ nxt_int_t nxt_http_route_addr_pattern_parse(nxt_mp_t *mp, nxt_http_route_addr_pattern_t *pattern, nxt_conf_value_t *cv) { - u_char *delim, *end; + u_char *delim; nxt_int_t ret, cidr_prefix; nxt_str_t addr, port; nxt_http_route_addr_base_t *base; @@ -59,6 +59,7 @@ nxt_http_route_addr_pattern_parse(nxt_mp_t *mp, if (nxt_str_looks_like_ipv6(&addr)) { #if (NXT_INET6) + u_char *end; uint8_t i; nxt_int_t len; nxt_http_route_in6_addr_range_t *inet6; @@ -179,7 +180,10 @@ nxt_http_route_addr_pattern_parse(nxt_mp_t *mp, return NXT_ADDR_PATTERN_FORMAT_ERROR; } - nxt_inet6_addr(&inet6->start, addr.start, addr.length); + ret = nxt_inet6_addr(&inet6->start, addr.start, addr.length); + if (nxt_slow_path(ret != NXT_OK)) { + return NXT_ADDR_PATTERN_FORMAT_ERROR; + } goto parse_port; #endif -- cgit From f860c20a96d9d844aad53f81dfcfc72f30ff977e Mon Sep 17 00:00:00 2001 From: Valentin Bartenev Date: Tue, 28 Jan 2020 19:18:26 +0300 Subject: PHP: added check for the ".php" extension. A check for the ".php" extension is added to prevent execution of files with arbitrary extensions in cases where "index" and "script" options aren't used. --- src/nxt_php_sapi.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/nxt_php_sapi.c b/src/nxt_php_sapi.c index 0f6ce686..26bf915f 100644 --- a/src/nxt_php_sapi.c +++ b/src/nxt_php_sapi.c @@ -599,20 +599,27 @@ nxt_php_request_handler(nxt_unit_request_info_t *req) path.start = nxt_unit_sptr_get(&r->path); if (nxt_php_script_filename.start == NULL) { + nxt_str_null(&script_name); + ctx->path_info.start = (u_char *) strstr((char *) path.start, ".php/"); if (ctx->path_info.start != NULL) { ctx->path_info.start += 4; path.length = ctx->path_info.start - path.start; ctx->path_info.length = r->path_length - path.length; - } - if (path.start[path.length - 1] == '/') { + } else if (path.start[path.length - 1] == '/') { script_name = nxt_php_index; } else { - script_name.length = 0; - script_name.start = NULL; + if (nxt_slow_path(path.length < 4 + || nxt_memcmp(path.start + (path.length - 4), + ".php", 4))) + { + nxt_unit_request_done(req, NXT_UNIT_ERROR); + + return; + } } ctx->script_filename.length = nxt_php_root.length + path.length -- cgit From 224549a578084854ab7656e01de82119a196f47b Mon Sep 17 00:00:00 2001 From: Max Romanov Date: Mon, 3 Feb 2020 11:13:55 +0300 Subject: Freeing memory allocated for engine structure in case of error. Found by Coverity (CID 353389). --- src/nxt_event_engine.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src') diff --git a/src/nxt_event_engine.c b/src/nxt_event_engine.c index 6f051067..4384d3b1 100644 --- a/src/nxt_event_engine.c +++ b/src/nxt_event_engine.c @@ -156,9 +156,9 @@ signals_fail: #if 0 fibers_fail: +#endif nxt_free(engine); -#endif return NULL; } -- cgit From 51120e06e32502c75010644d8b63086221ea78f9 Mon Sep 17 00:00:00 2001 From: Max Romanov Date: Mon, 3 Feb 2020 11:14:06 +0300 Subject: Added missing stream argument to error message. Found by Coverity (CID 353386). --- src/nxt_unit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/nxt_unit.c b/src/nxt_unit.c index 95874db3..27dc4751 100644 --- a/src/nxt_unit.c +++ b/src/nxt_unit.c @@ -871,7 +871,8 @@ nxt_unit_process_new_port(nxt_unit_ctx_t *ctx, nxt_unit_recv_msg_t *recv_msg) if (nxt_slow_path(ioctl(recv_msg->fd, FIONBIO, &nb) == -1)) { nxt_unit_alert(ctx, "#%"PRIu32": new_port: ioctl(%d, FIONBIO, 0) " - "failed: %s (%d)", recv_msg->fd, strerror(errno), errno); + "failed: %s (%d)", + recv_msg->stream, recv_msg->fd, strerror(errno), errno); return NXT_UNIT_ERROR; } -- cgit From 8c0f2cebf5eba555d104c42b556e54635f5d0890 Mon Sep 17 00:00:00 2001 From: Max Romanov Date: Mon, 3 Feb 2020 11:14:14 +0300 Subject: Storing pointer to next buffer in chain before free the buffer. This is required to avoid dereference of freed memory. Found by Coverity (CID 353372). --- src/nxt_buf_pool.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/nxt_buf_pool.c b/src/nxt_buf_pool.c index 8259c60a..f2be88a7 100644 --- a/src/nxt_buf_pool.c +++ b/src/nxt_buf_pool.c @@ -172,11 +172,12 @@ nxt_buf_pool_free(nxt_buf_pool_t *bp, nxt_buf_t *b) void nxt_buf_pool_destroy(nxt_buf_pool_t *bp) { - nxt_buf_t *b; + nxt_buf_t *b, *n; bp->destroy = 1; - for (b = bp->free; b != NULL; b = b->next) { + for (b = bp->free; b != NULL; b = n) { + n = b->next; nxt_buf_free(bp->mem_pool, b); } -- cgit From 7ea9ebc55a22fec53bb095975e639d4fbfebb575 Mon Sep 17 00:00:00 2001 From: Max Romanov Date: Mon, 3 Feb 2020 11:20:59 +0300 Subject: Fixed req_app_link reference counting on cancellation. Re-scheduled req_app_link structures should have use_count exactly equal to the number of references from the application and port list. However, there's one extra usage decrement that occurs after the req_app_link is created because the use_count is initialised as 1. This patch removes all excess instances of the usage decrement that caused preliminary req_app_link release and router process crash. To reproduce the issue need to cause request rescheduling between 2 app processes. This issue was introduced in 61e9f23a566d. --- src/nxt_router.c | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-) (limited to 'src') diff --git a/src/nxt_router.c b/src/nxt_router.c index 6a1f3792..3ff048c5 100644 --- a/src/nxt_router.c +++ b/src/nxt_router.c @@ -3750,8 +3750,6 @@ nxt_router_response_error_handler(nxt_task_t *task, nxt_port_recv_msg_t *msg, nxt_router_app_prepare_request(task, req_app_link); } - nxt_request_app_link_use(task, req_app_link, -1); - msg->port_msg.last = 0; return; @@ -4220,28 +4218,23 @@ re_ra_cancelled: if (nxt_router_port_post_select(task, &state) == NXT_OK) { /* * There should be call nxt_request_app_link_inc_use(re_ra), - * but we need to decrement use then. So, let's skip both. + * because of one more link in the queue. + * Corresponding decrement is in nxt_router_app_process_request(). */ + nxt_request_app_link_inc_use(re_ra); + nxt_work_queue_add(&task->thread->engine->fast_work_queue, nxt_router_app_process_request, &task->thread->engine->task, app, re_ra); - - } else { - /* - * This call should be unconditional, but we want to spare - * couple of CPU ticks to postpone the head death of the universe. - */ - - nxt_request_app_link_use(task, re_ra, -1); } } if (req_app_link != NULL) { /* - * Here we do the same trick as described above, - * but without conditions. - * Skip required nxt_request_app_link_inc_use(req_app_link). + * There should be call nxt_request_app_link_inc_use(req_app_link), + * because of one more link in the queue. But one link was + * recently removed from app->requests link. */ nxt_work_queue_add(&task->thread->engine->fast_work_queue, @@ -5205,8 +5198,6 @@ nxt_router_app_timeout(nxt_task_t *task, void *obj, void *data) if (nxt_router_port_post_select(task, &state) == NXT_OK) { nxt_router_app_prepare_request(task, pending_ra); } - - nxt_request_app_link_use(task, pending_ra, -1); } nxt_debug(task, "send quit to app '%V' pid %PI", &app->name, port->pid); -- cgit From 8eba2e5c3d8537521d3e010025e6078bc1fd28d6 Mon Sep 17 00:00:00 2001 From: Max Romanov Date: Mon, 3 Feb 2020 11:21:21 +0300 Subject: Initializing local buffer ctx_impl field for correct release. Uninitialized ctx_impl field may cause crash in application process. To reproduce the issue, need to trigger shared memory buffer send error on application side. In our case, send error caused by router process crash. This issue was introduced in 2c7f79bf0a1f. --- src/nxt_unit.c | 1 + 1 file changed, 1 insertion(+) (limited to 'src') diff --git a/src/nxt_unit.c b/src/nxt_unit.c index 27dc4751..ab622e56 100644 --- a/src/nxt_unit.c +++ b/src/nxt_unit.c @@ -3207,6 +3207,7 @@ nxt_unit_get_outgoing_buf(nxt_unit_ctx_t *ctx, nxt_unit_process_t *process, mmap_buf->port_id = *port_id; mmap_buf->process = process; mmap_buf->free_ptr = NULL; + mmap_buf->ctx_impl = nxt_container_of(ctx, nxt_unit_ctx_impl_t, ctx); nxt_unit_debug(ctx, "outgoing mmap allocation: (%d,%d,%d)", (int) hdr->id, (int) c, -- cgit From 7c38650cd12b9d5b14aec5d416fa3b57918cee50 Mon Sep 17 00:00:00 2001 From: Max Romanov Date: Tue, 4 Feb 2020 11:39:16 +0300 Subject: Removing duplicate macro definitions. This issue was introduced in 2c7f79bf0a1f. --- src/nxt_unit.c | 4 ---- 1 file changed, 4 deletions(-) (limited to 'src') diff --git a/src/nxt_unit.c b/src/nxt_unit.c index ab622e56..7c3d945c 100644 --- a/src/nxt_unit.c +++ b/src/nxt_unit.c @@ -19,10 +19,6 @@ #include #endif -#define NXT_UNIT_MAX_PLAIN_SIZE 1024 -#define NXT_UNIT_LOCAL_BUF_SIZE \ - (NXT_UNIT_MAX_PLAIN_SIZE + sizeof(nxt_port_msg_t)) - #define NXT_UNIT_MAX_PLAIN_SIZE 1024 #define NXT_UNIT_LOCAL_BUF_SIZE \ (NXT_UNIT_MAX_PLAIN_SIZE + sizeof(nxt_port_msg_t)) -- cgit From 29d8b34244e24095f23f5e483f8452035fbb77aa Mon Sep 17 00:00:00 2001 From: Tiago Natel de Moura Date: Wed, 5 Feb 2020 13:12:31 +0000 Subject: Kept the value of c->socket.read_handler while data is available. This closes #370 in GitHub. --- src/nxt_openssl.c | 4 ---- 1 file changed, 4 deletions(-) (limited to 'src') diff --git a/src/nxt_openssl.c b/src/nxt_openssl.c index 53ed0381..832d1f0d 100644 --- a/src/nxt_openssl.c +++ b/src/nxt_openssl.c @@ -633,10 +633,6 @@ nxt_openssl_conn_io_recvbuf(nxt_conn_t *c, nxt_buf_t *b) c->socket.fd, b->mem.free, size, ret, err); if (ret > 0) { - if ((size_t) ret < size) { - c->socket.read_ready = 0; - } - return ret; } -- cgit