From: Maxim Dounin <mdounin@mdounin.ru>
Date: Fri, 26 Jun 2026 19:23:25 +0000 (+0300)
Subject: Perl: added handler type checks
X-Git-Tag: release-1.31.3~18
X-Git-Url: http://git.kaiwu.me/http/$%7BGITURL%7D/doc/static/gitweb.js?a=commitdiff_plain;h=a6a942fd6a7e18cc168a4c0281118d08181d668f;p=nginx.git

Perl: added handler type checks

Previously, calling $r->sleep() and $r->has_request_body() with an
invalid handler argument, such as a string, resulted in a segmentation
fault.

Signed-off-by: Sergey Kandaurov <pluknet@nginx.com>
Origin: https://freenginx.org/hg/nginx/rev/2442b26850b1
---

diff --git a/src/http/modules/perl/nginx.xs b/src/http/modules/perl/nginx.xs
index fd59e29ea..1fcb32e73 100644
--- a/src/http/modules/perl/nginx.xs
+++ b/src/http/modules/perl/nginx.xs
@@ -395,6 +395,7 @@ has_request_body(r, next)
     dXSTARG;
     ngx_http_request_t   *r;
     ngx_http_perl_ctx_t  *ctx;
+    SV                   *next;
     ngx_int_t             rc;
 
     ngx_http_perl_set_request(r, ctx);
@@ -411,7 +412,13 @@ has_request_body(r, next)
         XSRETURN_UNDEF;
     }
 
-    ctx->next = SvRV(ST(1));
+    next = ST(1);
+
+    if (!SvROK(next) || SvTYPE(SvRV(next)) != SVt_PVCV) {
+        croak("has_request_body(): no handler provided");
+    }
+
+    ctx->next = SvRV(next);
 
     r->request_body_in_single_buf = 1;
     r->request_body_in_persistent_file = 1;
@@ -1129,6 +1136,7 @@ sleep(r, sleep, next)
 
     ngx_http_request_t   *r;
     ngx_http_perl_ctx_t  *ctx;
+    SV                   *next;
     ngx_msec_t            sleep;
 
     ngx_http_perl_set_request(r, ctx);
@@ -1146,7 +1154,13 @@ sleep(r, sleep, next)
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                    "perl sleep: %M", sleep);
 
-    ctx->next = SvRV(ST(2));
+    next = ST(2);
+
+    if (!SvROK(next) || SvTYPE(SvRV(next)) != SVt_PVCV) {
+        croak("sleep(): no handler provided");
+    }
+
+    ctx->next = SvRV(next);
 
     r->connection->write->delayed = 1;
     ngx_add_timer(r->connection->write, sleep);