From: Aleksei Bavshin <a.bavshin@nginx.com>
Date: Thu, 16 Jul 2026 15:53:21 +0000 (-0700)
Subject: Script: improved compatibility of complex value codes
X-Git-Tag: release-1.31.4~13
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=4b90ec769235877ece7e104d992d17db665806da;p=nginx.git

Script: improved compatibility of complex value codes

In a8289aa69c74, we introduced a new code to finalize the evaluation of
a complex value, deferring the stack update to this new code.  However,
the change inadvertently broke compatibility with several third-party
modules that were reusing ngx_http_script_complex_value_code.

This change relegates omitted ngx_http_script_complex_value_end_code
from crash to a potential read of uninitialized bytes at the end of the
allocated buffer.
---

diff --git a/src/http/ngx_http_script.c b/src/http/ngx_http_script.c
index 4d0a67084..6d41cc720 100644
--- a/src/http/ngx_http_script.c
+++ b/src/http/ngx_http_script.c
@@ -1867,20 +1867,28 @@ ngx_http_script_complex_value_code(ngx_http_script_engine_t *e)
 
     e->pos = e->buf.data;
     e->end = e->buf.data + len;
+
+    e->sp->len = e->buf.len;
+    e->sp->data = e->buf.data;
+    e->sp++;
 }
 
 
 void
 ngx_http_script_complex_value_end_code(ngx_http_script_engine_t *e)
 {
+    ngx_http_variable_value_t  *val;
+
+    val = e->sp - 1;
+
     e->ip += sizeof(ngx_http_script_complex_value_end_code_t);
 
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, e->request->connection->log, 0,
                    "http script complex value end");
 
-    e->sp->len = e->pos - e->buf.data;
-    e->sp->data = e->buf.data;
-    e->sp++;
+    if (val->data == e->buf.data) {
+        val->len = e->pos - e->buf.data;
+    }
 }