id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc	uname	nginx_version
600	segfault in ngx_http_get_variable()	Xiaochen Wang	Valentin V. Bartenev	"easy to reproduce:

1. nginx configure:
{{{
        location / {
            set $sent_http_foo ""bar"";
            ssi on;
            root   html;
        }
}}}
2. The content of html/index.html is '<!--#echo var=""sent_http_foo"" -->'
3. Requesting uri /index.html will trigger the segfault

coredump backtrace:

{{{
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x0000000000438555 in ngx_http_get_variable (r=0xbe87f0, name=<value optimized out>, key=<value optimized out>) at src/http/ngx_http_variables.c:565
#2  0x000000000044b50f in ngx_http_ssi_echo (r=0xbe87f0, ctx=0xbe9ab8, params=0x7fff6d998cb0) at src/http/modules/ngx_http_ssi_filter_module.c:2262
...
(gdb) frame 1
#1  0x0000000000438555 in ngx_http_get_variable (r=0xbe87f0, name=<value optimized out>,
    key=<value optimized out>) at src/http/ngx_http_variables.c:565
565                 if (vv && v->get_handler(r, vv, v->data) == NGX_OK) {
(gdb) print vv
$7 = (ngx_http_variable_value_t *) 0xbea000
(gdb) print v->get_handler
$8 = (ngx_http_get_variable_pt) 0                     <<< v->get_handler is NULL
}}}

Another module ngx.lua (https://github.com/openresty/lua-nginx-module), using ngx_http_get_variable() api, will trigger this segfault too. 

See configure as following, requesting uri / will trigger the segfault.

{{{
        location / {
            set $http_foo ""bar"";
            content_by_lua ""ngx.say(ngx.var.http_foo)"";
        }
}}}
"	defect	closed	minor		nginx-core		fixed			Linux *** 2.6.18-164.el5 #1 SMP Tue Aug 18 15:51:48 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux	"nginx version: nginx/1.7.2
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-52)"