]> git.kaiwu.me - njs.git/commitdiff
HTTP: avoiding arithmetic ops with NULL pointer in r.args getter.
authorDmitry Volyntsev <xeioex@nginx.com>
Thu, 11 Jan 2024 23:13:47 +0000 (15:13 -0800)
committerDmitry Volyntsev <xeioex@nginx.com>
Thu, 11 Jan 2024 23:13:47 +0000 (15:13 -0800)
Found by UndefinedBehaviorSanitizer.

nginx/ngx_http_js_module.c

index 8ed5972ea3fbade3d9a3fbdc348fd60a542e0f12..5384bd0a0252f0f6dde62e2de96a0a38913ef0c8 100644 (file)
@@ -2615,7 +2615,8 @@ static njs_int_t
 ngx_http_js_ext_get_args(njs_vm_t *vm, njs_object_prop_t *prop,
     njs_value_t *value, njs_value_t *setval, njs_value_t *retval)
 {
-    njs_int_t           ret;
+    u_char              *data;
+    njs_int_t            ret;
     njs_value_t         *args;
     ngx_http_js_ctx_t   *ctx;
     ngx_http_request_t  *r;
@@ -2631,8 +2632,8 @@ ngx_http_js_ext_get_args(njs_vm_t *vm, njs_object_prop_t *prop,
     args = njs_value_arg(&ctx->args);
 
     if (njs_value_is_null(args)) {
-        ret = njs_vm_query_string_parse(vm, r->args.data,
-                                        r->args.data + r->args.len, args);
+        data = (r->args.len != 0) ? r->args.data : (u_char *) "";
+        ret = njs_vm_query_string_parse(vm, data, data + r->args.len, args);
 
         if (ret == NJS_ERROR) {
             return NJS_ERROR;