Welcome! Log In Create A New Profile

Advanced

ngx_http_variable_unknown_header() derefances null pointer

Franchoze Eric
September 03, 2010 04:08PM
Got segfault at src/http/ngx_http_upstream.c:3905

0.8.49
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-48)

ngx_int_t
ngx_http_upstream_header_variable(ngx_http_request_t *r,
ngx_http_variable_value_t *v, uintptr_t data)
{
if (r->upstream == NULL) {
v->not_found = 1;
return NGX_OK;
}

return ngx_http_variable_unknown_header(v, (ngx_str_t *) data,
&r->upstream->headers_in.headers.part,
sizeof("upstream_http_") - 1);
}

....
ngx_http_variable_unknown_header () {
v->len = header[i].value.len;
v->valid = 1;

}


[New process 6511]
#0 ngx_http_upstream_header_variable (r=0x816aab0, v=0x0, data=12618048)
at src/http/ngx_http_upstream.c:3905
3905 return ngx_http_variable_unknown_header(v, (ngx_str_t *) data,
(gdb) bt
#0 ngx_http_upstream_header_variable (r=0x816aab0, v=0x0, data=12618048)
at src/http/ngx_http_upstream.c:3905
#1 0x000000000816aab0 in ?? ()
#2 0x0000000000afa068 in ?? ()
#3 0x0000000000436a92 in ngx_http_upstream_check_broken_connection (r=0x1f3, ev=0x816aab0)
at src/http/ngx_http_upstream.c:1026
#4 0x0000000000436b17 in ngx_http_upstream_check_broken_connection (r=0x5, ev=0x0)
at src/http/ngx_http_upstream.c:1048
#5 0x0000000000464609 in ngx_http_memc_process_simple_header (r=0x816aab0)
at src/ngx_http_memc_response.c:3230
#6 0x0000000000889110 in ?? ()
#7 0x0000000000889110 in ?? ()
#8 0x000000000041d3b0 in ngx_worker_process_cycle (cycle=0xfffffffffffffffd, data=<value optimized out>)
at src/os/unix/ngx_process_cycle.c:775
#9 0x000000000041bcf7 in ngx_spawn_process (cycle=0x889110, proc=0x41d2e8 <ngx_worker_process_exit+356>,
data=0x0, name=0x12ad835865e <Address 0x12ad835865e out of bounds>, respawn=<value optimized out>)
at src/os/unix/ngx_process.c:189
#10 0x000000000041ca49 in ngx_start_worker_processes (cycle=0x816aab0, n=12, type=-3)
at src/os/unix/ngx_process_cycle.c:347
#11 0x000000000041d914 in ngx_master_process_cycle (cycle=0x889110) at src/os/unix/ngx_process_cycle.c:128
#12 0x00000000004044da in main (argc=22, argv=0x8880e0) at src/core/nginx.c:385
(gdb) up
#1 0x000000000816aab0 in ?? ()
(gdb) up
#2 0x0000000000afa068 in ?? ()












Core was generated by `nginx: worker process '.
Program terminated with signal 11, Segmentation fault.
[New process 6511]
#0 ngx_http_upstream_header_variable (r=0x816aab0, v=0x0, data=12618048)
at src/http/ngx_http_upstream.c:3905
3905 return ngx_http_variable_unknown_header(v, (ngx_str_t *) data,
(gdb) l
3900 if (r->upstream == NULL) {
3901 v->not_found = 1;
3902 return NGX_OK;
3903 }
3904
3905 return ngx_http_variable_unknown_header(v, (ngx_str_t *) data,
3906 &r->upstream->headers_in.headers.part,
3907 sizeof("upstream_http_") - 1);
3908 }
3909
(gdb) p r->upstream
$1 = (ngx_http_upstream_t *) 0xc08940
(gdb) p r->upstream->headers_in
$2 = {headers = {last = 0x4f4e20524f432050, part = {elts = 0x50206f4153502049,
nelts = 2329017704099300435, next = 0x56454420614d4441}, size = 6143508379677433953,
nalloc = 4705734159867650131, pool = 0x4f4320544e492056}, status_n = 6147448956320424013,
status_line = {len = 5931276225493606482,
data = 0x4946204145482045 <Address 0x4946204145482045 out of bounds>}, status = 0x4f502043544f204e,
date = 0x697078450a0d224c, server = 0x6e6f4d203a736572, connection = 0x6e614a203632202c,
expires = 0x3530203830303220, etag = 0x472030303a30303a, x_accel_expires = 0x7473614c0a0d544d,
x_accel_redirect = 0x65696669646f4d2d, x_accel_limit_rate = 0x202c697246203a64,
content_type = 0x3220706553203330, content_length = 0x323a353120303130,
last_modified = 0x544d472030313a37, location = 0x2d65686361430a0d, accept_ranges = 0x3a6c6f72746e6f43,
www_authenticate = 0x726f74732d6f6e20, content_encoding = 0x61632d6f6e202c65,
content_length_n = 8319675871588083811, cache_control = {elts = 0x696c617665722d74,
nelts = 8029953510654370148, size = 7738140083767571571, nalloc = 3271146530256203837,
pool = 0xd303d6b63656863}}
(gdb) p r->upstream->headers_in.part
There is no member named part.
(gdb) p r->upstream->headers_in.headers
$3 = {last = 0x4f4e20524f432050, part = {elts = 0x50206f4153502049, nelts = 2329017704099300435,
next = 0x56454420614d4441}, size = 6143508379677433953, nalloc = 4705734159867650131,
pool = 0x4f4320544e492056}
(gdb) p r->upstream->headers_in.headers.part
$4 = {elts = 0x50206f4153502049, nelts = 2329017704099300435, next = 0x56454420614d4441}
(gdb)






_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

ngx_http_variable_unknown_header() derefances null pointer

Franchoze Eric 1563 September 03, 2010 04:08PM

Re: ngx_http_variable_unknown_header() derefances null pointer

Maxim Dounin 758 September 03, 2010 06:46PM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 92
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready