fix: at line 107 of ngx_stream_lua_log_ringbuf in...

[orbisai0security]

Summary

Fix critical severity security issue in src/ngx_stream_lua_log_ringbuf.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	src/ngx_stream_lua_log_ringbuf.c:107

Description: At line 107 of ngx_stream_lua_log_ringbuf.c, the function copies n bytes from a caller-supplied buffer into the ring buffer at the tail pointer using ngx_memcpy. There is no validation that n is less than or equal to the remaining capacity of the ring buffer (rb->end - rb->tail). If n exceeds the available space, the copy operation writes beyond the end of the allocated ring buffer, corrupting adjacent heap memory. This can overwrite heap metadata, function pointers, or other critical data structures managed by the nginx allocator.

Changes

• src/ngx_stream_lua_log_ringbuf.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[zhuizhuhaomeng]

The check is dead code. The only caller ngx_stream_lua_log_ringbuf_write (lines 167–197) already guarantees the bounds before calling append

[orbisai0security]

Thanks for checking. I agree with your analysis: the current call path through ngx_stream_lua_log_ringbuf_write() already enforces n + HEADER_LEN <= rb->size and ensures sufficient free/contiguous space before ngx_stream_lua_log_ringbuf_append() is called, so my added check is redundant in the current code.

Also noted that this file is generated from src/subsys/ngx_subsys_lua_log_ringbuf.c.tt2, so any future change should target the template rather than the generated C file.