{"action":"created","issue":{"url":"https://api.github.com/repos/openresty/lua-nginx-module/issues/605","labels_url":"https://api.github.com/repos/openresty/lua-nginx-module/issues/605/labels{/name}","comments_url":"https://api.github.com/repos/openresty/lua-nginx-module/issues/605/comments","events_url":"https://api.github.com/repos/openresty/lua-nginx-module/issues/605/events","html_url":"https://github.com/openresty/lua-nginx-module/pull/605","id":118312269,"number":605,"title":"fixed a bug that nginx crashed when processing requests with no args","user":{"login":"cfsego","id":1188207,"avatar_url":"https://avatars.githubusercontent.com/u/1188207?v=3","gravatar_id":"","url":"https://api.github.com/users/cfsego","html_url":"https://github.com/cfsego","followers_url":"https://api.github.com/users/cfsego/followers","following_url":"https://api.github.com/users/cfsego/following{/other_user}","gists_url":"https://api.github.com/users/cfsego/gists{/gist_id}","starred_url":"https://api.github.com/users/cfsego/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cfsego/subscriptions","organizations_url":"https://api.github.com/users/cfsego/orgs","repos_url":"https://api.github.com/users/cfsego/repos","events_url":"https://api.github.com/users/cfsego/events{/privacy}","received_events_url":"https://api.github.com/users/cfsego/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-11-23T03:14:58Z","updated_at":"2015-11-23T03:48:37Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openresty/lua-nginx-module/pulls/605","html_url":"https://github.com/openresty/lua-nginx-module/pull/605","diff_url":"https://github.com/openresty/lua-nginx-module/pull/605.diff","patch_url":"https://github.com/openresty/lua-nginx-module/pull/605.patch"},"body":"    If the length of r->variables is greater than 250, it is alloced by\r\nngx_palloc_large(), in specific, by malloc. And if r->uri.len equals to 0,\r\nngx_http_lua_ngx_req_get_uri_args() allocates a zero-length buffer in a\r\npool. We found that when we use jemalloc or tcmalloc, these two pointers\r\nare probably the same. Therefore, free this buffer will destroy r->variables\r\nby chance, and nginx crashes."},"comment":{"url":"https://api.github.com/repos/openresty/lua-nginx-module/issues/comments/158846900","html_url":"https://github.com/openresty/lua-nginx-module/pull/605#issuecomment-158846900","issue_url":"https://api.github.com/repos/openresty/lua-nginx-module/issues/605","id":158846900,"user":{"login":"agentzh","id":56241,"avatar_url":"https://avatars.githubusercontent.com/u/56241?v=3","gravatar_id":"","url":"https://api.github.com/users/agentzh","html_url":"https://github.com/agentzh","followers_url":"https://api.github.com/users/agentzh/followers","following_url":"https://api.github.com/users/agentzh/following{/other_user}","gists_url":"https://api.github.com/users/agentzh/gists{/gist_id}","starred_url":"https://api.github.com/users/agentzh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/agentzh/subscriptions","organizations_url":"https://api.github.com/users/agentzh/orgs","repos_url":"https://api.github.com/users/agentzh/repos","events_url":"https://api.github.com/users/agentzh/events{/privacy}","received_events_url":"https://api.github.com/users/agentzh/received_events","type":"User","site_admin":false},"created_at":"2015-11-23T03:48:37Z","updated_at":"2015-11-23T03:48:37Z","body":"@cfsego You don't need to know how Lua works for that. Just avoid calling `ngx_palloc` when `len == 0`. Right now you simply avoid calling `ngx_pfree` when `len == 0` which looks hacky."}}