Potential infinity cycle in ngx_http_upstream_send_request_body()

[SvyatoslavRazmyslov@…]

I have found a bug using ​PVS-Studio static analyzer for C/C++/C#.

V1021 The 'cl' variable is assigned the same value on several loop iterations. ngx_http_upstream.c 2138

if (r->request_body->bufs) {
  for (cl = out; cl->next; cl = out->next) { /* void */ } // <= bug
  cl->next = r->request_body->bufs;
  r->request_body->bufs = NULL;
}

Corrected code:

for (cl = out; cl->next; cl = cl->next) { /* void */ }

[vl]

Thanks for reporting.
Looks like currently chain link is a single item in this place, so nothing bad happens
in vanilla nginx.

[Vladimir Homutov <vl@…>]

In 7341:15ea84e65d07/nginx:

Upstream: fixed request chain traversal (ticket #1618).

The problem does not manifest itself currently, because in case of
non-buffered reading, chain link created by u->create_request method
consists of a single element.

Found by PVS-Studio.