[3.0] 88d785b Fix seg fault in VRT_synth_page when the string list has a NULL pointer as the first element.

Martin Blix Grydeland martin at varnish-cache.org
Mon Aug 12 12:29:46 CEST 2013


commit 88d785b3a963105dd76c49ba2e4303afabc5e1db
Author: Martin Blix Grydeland <martin at varnish-software.com>
Date:   Mon Jul 22 14:13:49 2013 +0200

    Fix seg fault in VRT_synth_page when the string list has a NULL
    pointer as the first element.
    
    Fixes: #1287

diff --git a/bin/varnishd/cache_vrt.c b/bin/varnishd/cache_vrt.c
index ca57b95..1b68107 100644
--- a/bin/varnishd/cache_vrt.c
+++ b/bin/varnishd/cache_vrt.c
@@ -407,9 +407,8 @@ VRT_synth_page(const struct sess *sp, unsigned flags, const char *str, ...)
 	vsb = SMS_Makesynth(sp->obj);
 	AN(vsb);
 
-	VSB_cat(vsb, str);
 	va_start(ap, str);
-	p = va_arg(ap, const char *);
+	p = str;
 	while (p != vrt_magic_string_end) {
 		if (p == NULL)
 			p = "(null)";
diff --git a/bin/varnishtest/tests/r01287.vtc b/bin/varnishtest/tests/r01287.vtc
new file mode 100644
index 0000000..bfa5ccb
--- /dev/null
+++ b/bin/varnishtest/tests/r01287.vtc
@@ -0,0 +1,21 @@
+varnishtest "#1287 - check NULL as first pointer to VRT_synth_page"
+
+server s1 {
+} -start
+
+varnish v1 -vcl+backend {
+	sub vcl_recv {
+		error 200 "OK";
+	}
+	sub vcl_error {
+		synthetic obj.http.blank;
+		return (deliver);
+	}
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 200
+	expect resp.body == "(null)"
+} -run



More information about the varnish-commit mailing list