nginx_upload_progress release 0.9.3 won't compile with nginx-1.27.0 and --with-debug option

[MMFuba]

Hi,
when compiling nginx-1.27.0 with nginx_upload_progress release 0.9.3 and --with-debug option gcc aborts with an error. Without the debug option compiling works fine.

How to reproduce:
./configure --prefix=/some/pref/nginxWB/build --add-module=/some/pref/nginxWB/nginx-upload-progress-module-master --with-debug

make

I get this error:
In function ‘ngx_http_uploadprogress_event_handler’:
src/core/ngx_log.h:93:9: error: pointer ‘dst’ may be used after ‘free’ [-Werror=use-after-free]
93 | ngx_log_error_core(NGX_LOG_DEBUG, log, VA_ARGS)

wsl:~/nginxWB/nginx-1.27.0> cc --version
cc (SUSE Linux) 13.3.0
Copyright (C) 2023 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Best regards

MM

[Liberstudio-Dev]

+1
I added this to compilation command, and the eror disapear:
CFLAGS="-Wno-error=use-after-free" ./configure

[BenBE]

+1 I added this to compilation command, and the error disapears: CFLAGS="-Wno-error=use-after-free" ./configure

You just hid the problem, instead of fixing it. The warning is there for a reason and in the worst case this constitutes a security bug you are hiding … ;-)

The proper fix is moving the affected logging instruction to a place where the memory hasn't been de-allocated yet.

@MMFuba Can you somehow pin down, which line exactly from ngx_http_uploadprogress_event_handler causes this diagnostic? Because the error message refers into some nginx header, thus is not very helpful for this.

And to be at least a bit productive with my rant: Please try this (quick-and-dirty) patch and report back if this resolves your problem:

$ git diff
diff --git a/ngx_http_uploadprogress_module.c b/ngx_http_uploadprogress_module.c
index 42598ab7..cb6f3e1d 100644
--- a/ngx_http_uploadprogress_module.c
+++ b/ngx_http_uploadprogress_module.c
@@ -502,9 +502,9 @@ static void ngx_http_uploadprogress_event_handler(ngx_http_request_t *r)
 
 
     if (shm_zone == NULL) {
-        ngx_http_uploadprogress_strdupfree(id);
         ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,
                        "upload-progress: read_event_handler no shm_zone for id: %V", id);
+        ngx_http_uploadprogress_strdupfree(id);
         return;
     }
 

I'll create a proper PR for this fix later.