Code Inconsistencies Detected by Static Analysis

[Anchels]

Return value of a function lua_touserdata is dereferenced without checking for NULL, but it is usually checked for this function:

lua-nginx-module/src/ngx_http_lua_socket_tcp.c

Lines 4662 to 4673 in 9688812

	cp = lua_touserdata(L, lua_upvalueindex(3));
	dd("checking existing state: %d", cp->state);
	if (cp->state == -1) {
	cp->state = 0;
	lua_pushnil(L);
	lua_pushnil(L);
	lua_pushnil(L);
	return 3;
	}

Similar issue with fucntion ngx_http_lua_get_req:

lua-nginx-module/src/ngx_http_lua_socket_tcp.c

Lines 5112 to 5117 in 9688812

	r = ngx_http_lua_get_req(L);
	if (r != r->main) {
	return luaL_error(L, "attempt to read the request body in a "
	"subrequest");
	}

After having been compared to a NULL value:

lua-nginx-module/src/ngx_http_lua_socket_tcp.c

Lines 1814 to 1816 in 9688812

	if (server_name != NULL && server_name->data != NULL) {
	ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
	"lua ssl server name: \"%V\"", server_name);

pointer server_name->data is dereferenced without null check by calling function memcpy:

lua-nginx-module/src/ngx_http_lua_socket_tcp.c

Lines 1855 to 1857 in 9688812

	ngx_memcpy(u->ssl_name.data, server_name->data,
	server_name->len);
	u->ssl_name.len = server_name->len;

Found by Linux Verification Center with SVACE

[splitice]

I think 1 should be fixed
I think 2 is fine due to r->main not being NULL.
I'm not sure I see the issue with 3 (you see thats does not equal right?)
It may be worth adding a check for 4 on

lua-nginx-module/src/ngx_http_lua_socket_tcp.c

Line 1846 in 9688812

if (server_name == NULL || server_name->len == 0) {

[Anchels]

@splitice, thank you for the feedback!

I think 2 is fine due to r->main not being NULL.

Do you mean that in this case r will never be NULL?

lua-nginx-module/src/ngx_http_lua_socket_tcp.c

Line 5112 in 9688812

r = ngx_http_lua_get_req(L);

I think it's worth adding a similar check:

lua-nginx-module/src/ngx_http_lua_socket_tcp.c

Lines 440 to 443 in 9688812

	r = ngx_http_lua_get_req(L);
	if (r == NULL) {
	return luaL_error(L, "no request found");
	}

---

I'm not sure I see the issue with 3 (you see thats does not equal right?)

There's no actual issue with 3. It's just indicating that server_name->data may have a NULL value. To clarify 4 🙂

[splitice]

You are right re; 2.