Skip to content

Conversation

StepanGulyaev
Copy link

The Svace SAST tool have found an issue in using of ngx_rtmp_exec_run function. The function has ngx_int_t return value type but this value is never checked throughout the code. For example:

ngx_rtmp_exec_run(e);

#if !(NGX_WIN32)
static void
ngx_rtmp_exec_respawn(ngx_event_t *ev)
{
ngx_rtmp_exec_run((ngx_rtmp_exec_t *) ev->data);
}

ngx_rtmp_exec_run(&en);

if (ngx_rtmp_exec_filter(s, en->conf) == NGX_OK) {
ngx_rtmp_exec_run(en);
}

All functions that call ngx_rtmp_exec_run are also static void functions so they can't send that value further up and it it's not convinient thing to do.

ngx_rtmp_exec_run prints all required debug data to logs and we won't lose anything if we remove return NGX_ERROR or NGX_OK values and SAST tools will stop triggering on those.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant