technocloud-public/nginx-unit
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fixed possible access to an uninitialized field.

Browse Source 
The "recv_msg.incoming_buf" is checked after jumping to the "done" label
if nxt_socket_msg_oob_get_fds() returns an error.

Also moved initialization of "port_msg" near to its first usage.

Found by Coverity (CID 373899).
This commit is contained in:
Valentin Bartenev
2021-11-23 15:36:24 +03:00
parent f30f8f06c9
commit 62d173f7af
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/nxt_unit.c
View File

@@ -937,9 +937,9 @@ nxt_unit_process_msg(nxt_unit_ctx_t *ctx, nxt_unit_read_buf_t *rbuf,
lib = nxt_container_of(ctx->unit, nxt_unit_impl_t, unit); lib = nxt_container_of(ctx->unit, nxt_unit_impl_t, unit);
recv_msg.incoming_buf = NULL;
recv_msg.fd[0] = -1; recv_msg.fd[0] = -1;
recv_msg.fd[1] = -1; recv_msg.fd[1] = -1;
port_msg = (nxt_port_msg_t *) rbuf->buf;
rc = nxt_socket_msg_oob_get_fds(&rbuf->oob, recv_msg.fd); rc = nxt_socket_msg_oob_get_fds(&rbuf->oob, recv_msg.fd);
if (nxt_slow_path(rc != NXT_OK)) { if (nxt_slow_path(rc != NXT_OK)) {
@@ -948,8 +948,6 @@ nxt_unit_process_msg(nxt_unit_ctx_t *ctx, nxt_unit_read_buf_t *rbuf,
goto done; goto done;
} }
recv_msg.incoming_buf = NULL;
if (nxt_slow_path(rbuf->size < (ssize_t) sizeof(nxt_port_msg_t))) { if (nxt_slow_path(rbuf->size < (ssize_t) sizeof(nxt_port_msg_t))) {
if (nxt_slow_path(rbuf->size == 0)) { if (nxt_slow_path(rbuf->size == 0)) {
nxt_unit_debug(ctx, "read port closed"); nxt_unit_debug(ctx, "read port closed");
@@ -965,6 +963,8 @@ nxt_unit_process_msg(nxt_unit_ctx_t *ctx, nxt_unit_read_buf_t *rbuf,
goto done; goto done;
} }
port_msg = (nxt_port_msg_t *) rbuf->buf;
nxt_unit_debug(ctx, "#%"PRIu32": process message %d fd[0] %d fd[1] %d", nxt_unit_debug(ctx, "#%"PRIu32": process message %d fd[0] %d fd[1] %d",
port_msg->stream, (int) port_msg->type, port_msg->stream, (int) port_msg->type,
recv_msg.fd[0], recv_msg.fd[1]); recv_msg.fd[0], recv_msg.fd[1]);