From ebf97195d69e226121ab6263b1f36cd0f64a2937 Mon Sep 17 00:00:00 2001 From: Gabriel Clima Date: Mon, 25 May 2026 07:23:57 +0000 Subject: [PATCH] bugfix: SIGSEGV in receiveuntil __gc on aborted multipart upload. read_error_retval_handler calls finalize_read_part directly when the receiveuntil iterator's recv errors. That clears u->buf_in but leaves cp->upstream live with cp->state > 0. Later GC fires cleanup_compiled_pattern -> read_prepare, which derefs the now-NULL u->buf_in. Mirror tcp_finalize's cp->upstream = NULL detach so __gc's existing `if (u != NULL)` guard short-circuits. --- src/ngx_http_lua_socket_tcp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/ngx_http_lua_socket_tcp.c b/src/ngx_http_lua_socket_tcp.c index ee4befa90b..027d534a5e 100644 --- a/src/ngx_http_lua_socket_tcp.c +++ b/src/ngx_http_lua_socket_tcp.c @@ -4203,6 +4203,12 @@ ngx_http_lua_socket_tcp_finalize_read_part(ngx_http_request_t *r, ngx_memzero(&u->buffer, sizeof(ngx_buf_t)); } + /* mirror tcp_finalize: detach cp so its __gc is safe */ + if (u->input_filter_ctx != NULL && u->input_filter_ctx != u) { + ((ngx_http_lua_socket_compiled_pattern_t *) + u->input_filter_ctx)->upstream = NULL; + } + if (u->raw_downstream || u->body_downstream) { if (r->connection->read->timer_set) { ngx_del_timer(r->connection->read);