Script: improved compatibility of complex value codes

In a8289aa69c, we introduced a new code to finalize the evaluation of
a complex value, deferring the stack update to this new code.  However,
the change inadvertently broke compatibility with several third-party
modules that were reusing ngx_http_script_complex_value_code.

This change relegates omitted ngx_http_script_complex_value_end_code
from crash to a potential read of uninitialized bytes at the end of the
allocated buffer.
This commit is contained in:
Aleksei Bavshin authored and Sergey Kandaurov committed 2026-10-02 18:33:28 +04:00
1 parent a18b3f170c
commit f496c50c51
1 file changed
+11 -3
+11 -3
View File
@@ -1867,20 +1867,28 @@ ngx_http_script_complex_value_code(ngx_http_script_engine_t *e)
e->pos = e->buf.data;
e->end = e->buf.data + len;
e->sp->len = e->buf.len;
e->sp->data = e->buf.data;
e->sp++;
}
void
ngx_http_script_complex_value_end_code(ngx_http_script_engine_t *e)
{
ngx_http_variable_value_t *val;
val = e->sp - 1;
e->ip += sizeof(ngx_http_script_complex_value_end_code_t);
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, e->request->connection->log, 0,
"http script complex value end");
e->sp->len = e->pos - e->buf.data;
e->sp->data = e->buf.data;
e->sp++;
if (val->data == e->buf.data) {
val->len = e->pos - e->buf.data;
}
}