bugfix: body_filter_by_lua*: reading ngx.arg[1] after clearing ngx.arg[1] (by assigning nil or "") could lead to segmentation faults. this regression had appeared in v0.9.10. thanks Jason Stangroome for the report in #398.

Author: agentzh

src/ngx_http_lua_bodyfilterby.c

@@ -383,6 +383,12 @@ ngx_http_lua_body_filter_param_get(lua_State *L)
 
     size = 0;
 
+    if (in == NULL) {
+        /* being a cleared chain on the Lua land */
+        lua_pushlstring(L, "", 0);
+        return 1;
+    }
+
     if (in->next == NULL) {
 
         dd("seen only single buffer");

t/082-body-filter.t

@@ -11,7 +11,7 @@ log_level('debug');
 
 repeat_each(2);
 
-plan tests => repeat_each() * (blocks() * 3 + 9);
+plan tests => repeat_each() * (blocks() * 3 + 13);
 
 #no_diff();
 no_long_string();
@@ -754,3 +754,72 @@ probe syscall.writev.return {
 [error]
 [alert]
 
+
+
+=== TEST 24: clear ngx.arg[1] and then read it
+--- config
+    location /t {
+        echo hello;
+        echo world;
+
+        body_filter_by_lua '
+            ngx.arg[1] = nil
+            local data = ngx.arg[1]
+            print([[data chunk: "]], data, [["]])
+
+            ngx.arg[1] = ""
+            data = ngx.arg[1]
+            print([[data chunk 2: "]], data, [["]])
+        ';
+    }
+--- request
+GET /t
+--- response_body
+--- log_level: info
+--- grep_error_log eval: qr/data chunk(?: \d+)?: [^,]+/
+--- grep_error_log_out
+data chunk: ""
+data chunk 2: ""
+data chunk: ""
+data chunk 2: ""
+data chunk: ""
+data chunk 2: ""
+--- no_error_log
+[error]
+[alert]
+
+
+
+=== TEST 25: clear ngx.arg[1] and then read ngx.arg[2]
+--- config
+    location /t {
+        echo hello;
+        echo world;
+
+        body_filter_by_lua '
+            ngx.arg[1] = nil
+            local eof = ngx.arg[2]
+            print([[eof: ]], eof)
+
+            ngx.arg[1] = ""
+            eof = ngx.arg[2]
+            print([[eof 2: ]], eof)
+        ';
+    }
+--- request
+GET /t
+--- response_body
+--- log_level: info
+--- grep_error_log eval: qr/eof(?: \d+)?: [^,]+/
+--- grep_error_log_out
+eof: false
+eof 2: false
+eof: false
+eof 2: false
+eof: true
+eof 2: true
+
+--- no_error_log
+[error]
+[alert]
+