bugfix: backport: avoid buf double free in ngx.print if lua body filt…

patch/1.21.4/ngx_lua-ngx-buf-double-free-bugfix.patch

@@ -0,0 +1,39 @@
+diff --git src/ngx_http_lua_bodyfilterby.c src/ngx_http_lua_bodyfilterby.c
+index 632f5afe..a8a382ac 100644
+--- src/ngx_http_lua_bodyfilterby.c
++++ src/ngx_http_lua_bodyfilterby.c
+@@ -299,7 +299,7 @@ ngx_http_lua_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
+         out = NULL;
+         ngx_chain_update_chains(r->pool,
+                                 &ctx->free_bufs, &ctx->filter_busy_bufs, &out,
+-                                (ngx_buf_tag_t) &ngx_http_lua_module);
++                                (ngx_buf_tag_t) &ngx_http_lua_body_filter);
+         if (rc != NGX_OK
+             && ctx->filter_busy_bufs != NULL
+             && (r->connection->buffered
+@@ -378,7 +378,7 @@ ngx_http_lua_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
+
+     ngx_chain_update_chains(r->pool,
+                             &ctx->free_bufs, &ctx->filter_busy_bufs, &out,
+-                            (ngx_buf_tag_t) &ngx_http_lua_module);
++                            (ngx_buf_tag_t) &ngx_http_lua_body_filter);
+
+     return rc;
+ }
+@@ -657,6 +657,7 @@ ngx_http_lua_body_filter_param_set(lua_State *L, ngx_http_request_t *r,
+         return luaL_error(L, "no memory");
+     }
+
++    cl->buf->tag = (ngx_buf_tag_t) &ngx_http_lua_body_filter;
+     if (type == LUA_TTABLE) {
+         cl->buf->last = ngx_http_lua_copy_str_in_table(L, 3, cl->buf->last);
+
+@@ -674,6 +675,8 @@ done:
+             if (cl == NULL) {
+                 return luaL_error(L, "no memory");
+             }
++
++            cl->buf->tag = (ngx_buf_tag_t) &ngx_http_lua_body_filter;
+         }
+
+         if (last) {

t/ngx-buf-double-free.t

@@ -0,0 +1,21 @@
+use t::APISIX_NGINX 'no_plan';
+
+run_tests();
+
+__DATA__
+
+=== TEST 1: ngx.say (integer)
+--- config
+    location /t {
+        content_by_lua_block {
+            local str = string.rep(".", 1300)
+            ngx.print(str)
+            ngx.flush()
+            ngx.print("small chunk")
+            ngx.flush()
+        }
+        body_filter_by_lua_block {local dummy=1}
+    }
+--- request
+GET /t
+--- response_body_like: small chunk