Possible NULL pointer dereference in nxt_cache_wake_handler()

Andrew Clayton andrew at digital-domain.net
Sat Jun 11 01:44:34 UTC 2022

So in src/nxt_cache.c we have the following function

static void                                                                     
nxt_cache_wake_handler(nxt_thread_t *thr, void *obj, void *data)                
    nxt_cache_t             *cache;                                             
    nxt_work_handler_t      handler;                                            
    nxt_cache_query_t       *q;                                                 
    nxt_cache_query_wait_t  *qw;                                                
    qw = obj;                                                                   
    q = qw->query;                                                              
    cache = qw->cache;                                                          
    handler = nxt_cache_node_test(cache, q);                                    
    if (handler != NULL) {                                                      
        nxt_cache_query_wait_free(cache, qw);                                   
    } else {                                                                    
        /* Wait again. */                                                       
        qw->next = q->node->waiting;                                            
        q->node->waiting = qw;                                                  
    handler(thr, q, NULL);                                                      

We set handler then check if it's NULL. However even if it is NULL we
still call it with

    handler(thr, q, NULL);

Or am I missing something?


More information about the unit mailing list