Version in base suite: 1.18.0-6.1 Base version: nginx_1.18.0-6.1 Target version: nginx_1.18.0-6.1+deb11u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/nginx/nginx_1.18.0-6.1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/n/nginx/nginx_1.18.0-6.1+deb11u1.dsc changelog | 8 +++++ modules/patches/http-lua/bug-994178-segfault.patch | 31 +++++++++++++++++++++ modules/patches/http-lua/series | 1 3 files changed, 40 insertions(+) diff -Nru nginx-1.18.0/debian/changelog nginx-1.18.0/debian/changelog --- nginx-1.18.0/debian/changelog 2021-05-29 14:21:37.000000000 +0000 +++ nginx-1.18.0/debian/changelog 2022-03-15 20:36:18.000000000 +0000 @@ -1,3 +1,11 @@ +nginx (1.18.0-6.1+deb11u1) bullseye; urgency=medium + + * Backport upstream bugfix for segfault in nginx core >= 1.15.0 when + libnginx-mod-http-lua is loaded and init_worker_by_lua* is used. + (Closes: #994178) + + -- Jan Mojžíš Tue, 15 Mar 2022 21:36:18 +0100 + nginx (1.18.0-6.1) unstable; urgency=high * Non-maintainer upload. diff -Nru nginx-1.18.0/debian/modules/patches/http-lua/bug-994178-segfault.patch nginx-1.18.0/debian/modules/patches/http-lua/bug-994178-segfault.patch --- nginx-1.18.0/debian/modules/patches/http-lua/bug-994178-segfault.patch 1970-01-01 00:00:00.000000000 +0000 +++ nginx-1.18.0/debian/modules/patches/http-lua/bug-994178-segfault.patch 2022-03-15 20:36:18.000000000 +0000 @@ -0,0 +1,31 @@ +From: Datong Sun +Date: Wed Jul 18 16:21:09 2018 -0700 +Origin: https://github.com/openresty/lua-nginx-module/commit/e94f2e5d64daa45ff396e262d8dab8e56f5f10e0 +Subject: fixed segfault in NGINX core >= 1.15.0 when init_worker_by_lua* is + used. + +Signed-off-by: Yichun Zhang (agentzh) + +diff --git a/src/ngx_http_lua_initworkerby.c b/src/ngx_http_lua_initworkerby.c +index 4a722a06..2a82fcb9 100644 +--- a/src/ngx_http_lua_initworkerby.c ++++ b/src/ngx_http_lua_initworkerby.c +@@ -25,6 +25,7 @@ ngx_http_lua_init_worker(ngx_cycle_t *cycle) + void *cur, *prev; + ngx_uint_t i; + ngx_conf_t conf; ++ ngx_conf_file_t cf_file; + ngx_cycle_t *fake_cycle; + ngx_module_t **modules; + ngx_open_file_t *file, *ofile; +@@ -166,6 +167,10 @@ ngx_http_lua_init_worker(ngx_cycle_t *cycle) + conf.pool = fake_cycle->pool; + conf.log = cycle->log; + ++ ngx_memzero(&cf_file, sizeof(cf_file)); ++ cf_file.file.name = cycle->conf_file; ++ conf.conf_file = &cf_file; ++ + http_ctx.loc_conf = ngx_pcalloc(conf.pool, + sizeof(void *) * ngx_http_max_module); + if (http_ctx.loc_conf == NULL) { diff -Nru nginx-1.18.0/debian/modules/patches/http-lua/series nginx-1.18.0/debian/modules/patches/http-lua/series --- nginx-1.18.0/debian/modules/patches/http-lua/series 2021-05-29 14:21:37.000000000 +0000 +++ nginx-1.18.0/debian/modules/patches/http-lua/series 2022-03-15 20:36:18.000000000 +0000 @@ -1,2 +1,3 @@ discover-luajit-2.1.patch CVE-2020-11724.patch +bug-994178-segfault.patch