From b0a4d0fb823b2d4820b333ed4ea4a2c0ad9a56c8 Mon Sep 17 00:00:00 2001 From: Andrew Clayton Date: Thu, 19 Mar 2026 04:21:21 +0000 Subject: Avoid undefined behaviour in ngx_pstrdup() In the third call to ngx_pstrdup() for setting cycle->conf_param.data in ngx_init_cycle() we would pass in a nulled ngx_str_t in the case there was no -g command line option passed to nginx. This would result in a memcpy(dst, NULL, 0) which up to and including C23 is Undefined Behaviour. Currently Clang and GCC (in this particular case) just treat this as a no-op, so things just happen to work. However some undefined behaviour sanitizers will throw an error when this is hit, e.g. Clang and the zig compiler and it's probably best not to rely on this behaviour. It's worth noting that the next C standard will make this (and other NULL related operations) defined behaviour. Link: Closes: https://github.com/nginx/nginx/issues/1079 --- src/core/ngx_cycle.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/core/ngx_cycle.c b/src/core/ngx_cycle.c index e5fd40285..410cc3cd2 100644 --- a/src/core/ngx_cycle.c +++ b/src/core/ngx_cycle.c @@ -114,11 +114,13 @@ ngx_init_cycle(ngx_cycle_t *old_cycle) ngx_cpystrn(cycle->conf_file.data, old_cycle->conf_file.data, old_cycle->conf_file.len + 1); - cycle->conf_param.len = old_cycle->conf_param.len; - cycle->conf_param.data = ngx_pstrdup(pool, &old_cycle->conf_param); - if (cycle->conf_param.data == NULL) { - ngx_destroy_pool(pool); - return NULL; + if (old_cycle->conf_param.len) { + cycle->conf_param.len = old_cycle->conf_param.len; + cycle->conf_param.data = ngx_pstrdup(pool, &old_cycle->conf_param); + if (cycle->conf_param.data == NULL) { + ngx_destroy_pool(pool); + return NULL; + } } -- cgit