dereferencing result of ngx_http_lua_get_req() without checking for NULL
Hello, static checker svacer found several places where we are not checking req object for NULL, while it provided counter-examples where we are doing so.
Problematic files:
https://github.com/openresty/lua-nginx-module/blob/5bd471a4bce6c02dd68b1ca72fbabb09fb2041d8/src/ngx_http_lua_socket_tcp.c#L5077-L5083
https://github.com/openresty/lua-nginx-module/blob/5bd471a4bce6c02dd68b1ca72fbabb09fb2041d8/src/ngx_http_lua_semaphore.c#L486-L488
https://github.com/openresty/lua-nginx-module/blob/5bd471a4bce6c02dd68b1ca72fbabb09fb2041d8/src/ngx_http_lua_semaphore.c#L530-L532
https://github.com/openresty/lua-nginx-module/blob/5bd471a4bce6c02dd68b1ca72fbabb09fb2041d8/src/ngx_http_lua_output.c#L490-L496
We have other places where we do proper checks
https://github.com/openresty/lua-nginx-module/blob/5bd471a4bce6c02dd68b1ca72fbabb09fb2041d8/src/ngx_http_lua_socket_tcp.c#L4521-L4525
and 4 more cases in ngx_http_lua_socket_tcp.c, plus one case in ngx_http_lua_util.c:
https://github.com/openresty/lua-nginx-module/blob/5bd471a4bce6c02dd68b1ca72fbabb09fb2041d8/src/ngx_http_lua_util.c#L3125-L3129
definition of ngx_http_lua_get_req() follows:
static ngx_inline ngx_http_request_t *
ngx_http_lua_get_req(lua_State *L)
{
#ifdef OPENRESTY_LUAJIT
return lua_getexdata(L);
#else
ngx_http_request_t *r;
lua_getglobal(L, ngx_http_lua_req_key);
r = lua_touserdata(L, -1);
lua_pop(L, 1);
return r;
#endif
}
And it seems, that we don't need to check result of the ngx_http_lua_get_req() as it just returns global object, which is http request object and it must be always available in context of the Lua code execution, because Lua code is always executed inside http request processing pipeline.
Is it right? Can you please confirm that it is false positive static analyzer case ?
If not, I can provide boring MR with trivial fixes.
Thanks!