From 4b90ec769235877ece7e104d992d17db665806da Mon Sep 17 00:00:00 2001 From: Aleksei Bavshin Date: Thu, 16 Jul 2026 08:53:21 -0700 Subject: [PATCH] Script: improved compatibility of complex value codes In a8289aa69c74, we introduced a new code to finalize the evaluation of a complex value, deferring the stack update to this new code. However, the change inadvertently broke compatibility with several third-party modules that were reusing ngx_http_script_complex_value_code. This change relegates omitted ngx_http_script_complex_value_end_code from crash to a potential read of uninitialized bytes at the end of the allocated buffer. --- src/http/ngx_http_script.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c index 4d0a67084..6d41cc720 100644 --- a/src/http/ngx_http_script.c +++ b/src/http/ngx_http_script.c @@ -1867,20 +1867,28 @@ ngx_http_script_complex_value_code(ngx_http_script_engine_t *e) e->pos = e->buf.data; e->end = e->buf.data + len; + + e->sp->len = e->buf.len; + e->sp->data = e->buf.data; + e->sp++; } void ngx_http_script_complex_value_end_code(ngx_http_script_engine_t *e) { + ngx_http_variable_value_t *val; + + val = e->sp - 1; + e->ip += sizeof(ngx_http_script_complex_value_end_code_t); ngx_log_debug0(NGX_LOG_DEBUG_HTTP, e->request->connection->log, 0, "http script complex value end"); - e->sp->len = e->pos - e->buf.data; - e->sp->data = e->buf.data; - e->sp++; + if (val->data == e->buf.data) { + val->len = e->pos - e->buf.data; + } }