From adbccddfe796e1e9acc32479b7a15b7c7ce09eb4 Mon Sep 17 00:00:00 2001
From: water <672684719@qq.com>
Date: Thu, 27 Aug 2026 12:57:35 +0800
Subject: [PATCH] bugfix: fix heap-use-after-free in receiveuntil after read
 error

ngx_http_lua_socket_tcp_finalize_read_part clears cp->upstream
but leaves u->input_filter_ctx pointing at the compiled pattern.
After a read error the iterator userdata becomes garbage-collected;
its __gc handler sees cp->upstream == NULL and does not clear
u->input_filter_ctx, leaving a dangling pointer. A later sock:close()
dereferences it in ngx_http_lua_socket_tcp_finalize, causing a
heap-use-after-free.

Clear u->input_filter_ctx on both sides of the relationship when
finalizing the read part, matching what tcp_finalize already does.
---
 src/ngx_http_lua_socket_tcp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/ngx_http_lua_socket_tcp.c b/src/ngx_http_lua_socket_tcp.c
index 08c02ae043..9b87273c9d 100644
--- a/src/ngx_http_lua_socket_tcp.c
+++ b/src/ngx_http_lua_socket_tcp.c
@@ -4215,6 +4215,7 @@ ngx_http_lua_socket_tcp_finalize_read_part(ngx_http_request_t *r,
     if (u->input_filter_ctx != NULL && u->input_filter_ctx != u) {
         ((ngx_http_lua_socket_compiled_pattern_t *)
          u->input_filter_ctx)->upstream = NULL;
+        u->input_filter_ctx = NULL;
     }
 
     if (u->raw_downstream || u->body_downstream) {