Fix inconsistency found by static analyzers
Hello! I was analyzing Nginx modules with the Svace static analyzer. It has found an inconsistency code at the following sections of the code:
https://github.com/samizdatco/nginx-http-auth-digest/blob/5a2cae4812d8a1ba5f83dfbcb8d043d05c8e6f97/ngx_http_auth_digest_module.c#L1227-L1247
and
https://github.com/samizdatco/nginx-http-auth-digest/blob/5a2cae4812d8a1ba5f83dfbcb8d043d05c8e6f97/ngx_http_auth_digest_module.c#L1286-L1308
In both methods the result value dropnode of method invocation ngx_array_push is dereferenced without checking for NULL:
https://github.com/samizdatco/nginx-http-auth-digest/blob/5a2cae4812d8a1ba5f83dfbcb8d043d05c8e6f97/ngx_http_auth_digest_module.c#L1245
and
https://github.com/samizdatco/nginx-http-auth-digest/blob/5a2cae4812d8a1ba5f83dfbcb8d043d05c8e6f97/ngx_http_auth_digest_module.c#L1306
Here's the source code for function ngx_array_push:
https://github.com/nginx/nginx/blob/ecb809305e54ed15be9f620d56b19ff4e4be7db5/src/core/ngx_array.c#L47-L91
Note that this function can return NULL. Therefore, when using it, it is important to check the result for NULL in order to avoid possible errors. And as a rule, such check is performed in other modules that use this function.
What do you think about adding the NULL checks?
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Similar issues, but with ngx_palloc function:
shm_name is dereferenced without checking for null:
https://github.com/samizdatco/nginx-http-auth-digest/blob/5a2cae4812d8a1ba5f83dfbcb8d043d05c8e6f97/ngx_http_auth_digest_module.c#L75-L76
same for *d:
https://github.com/samizdatco/nginx-http-auth-digest/blob/5a2cae4812d8a1ba5f83dfbcb8d043d05c8e6f97/ngx_http_auth_digest_module.c#L499-L517
Looks like it might be worth adding a Null check herу too:
HA2.data is dereferenced without checking for NULL:
https://github.com/samizdatco/nginx-http-auth-digest/blob/5a2cae4812d8a1ba5f83dfbcb8d043d05c8e6f97/ngx_http_auth_digest_module.c#L716
HA1.data here:
https://github.com/samizdatco/nginx-http-auth-digest/blob/5a2cae4812d8a1ba5f83dfbcb8d043d05c8e6f97/ngx_http_auth_digest_module.c#L675
and
auth_fields here:
https://github.com/samizdatco/nginx-http-auth-digest/blob/5a2cae4812d8a1ba5f83dfbcb8d043d05c8e6f97/ngx_http_auth_digest_module.c#L286