Script: improved compatibility of complex value codes

In a8289aa69c74, we introduced a new code to finalize the evaluation of
a complex value, deferring the stack update to this new code.  However,
the change inadvertently broke compatibility with several third-party
modules that were reusing ngx_http_script_complex_value_code.

This change relegates omitted ngx_http_script_complex_value_end_code
from crash to a potential read of uninitialized bytes at the end of the
allocated buffer.

diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c
index 4d0a6708432a999101212c4082eaaae7a852b4af..6d41cc720b0c855b38f88f815d164fcfd5d5b1bb 100644 (file)
--- a/src/http/ngx_http_script.c
+++ b/src/http/ngx_http_script.c
@@ -1867,20 +1867,28 @@ ngx_http_script_complex_value_code(ngx_http_script_engine_t *e)
 
     e->pos = e->buf.data;
     e->end = e->buf.data + len;
+
+    e->sp->len = e->buf.len;
+    e->sp->data = e->buf.data;
+    e->sp++;
 }
 
 
 void
 ngx_http_script_complex_value_end_code(ngx_http_script_engine_t *e)
 {
+    ngx_http_variable_value_t  *val;
+
+    val = e->sp - 1;
+
     e->ip += sizeof(ngx_http_script_complex_value_end_code_t);
 
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, e->request->connection->log, 0,
                    "http script complex value end");
 
-    e->sp->len = e->pos - e->buf.data;
-    e->sp->data = e->buf.data;
-    e->sp++;
+    if (val->data == e->buf.data) {
+        val->len = e->pos - e->buf.data;
+    }
 }