Skip to content

Conversation

StepanGulyaev
Copy link

The Svace SAST tool have found an issue in using of ngx_rtmp_exec_run function. The function has ngx_int_t return value type but this value is never checked throughout the code. For example:

ngx_rtmp_exec_run(e);

#if !(NGX_WIN32)
static void
ngx_rtmp_exec_respawn(ngx_event_t *ev)
{
ngx_rtmp_exec_run((ngx_rtmp_exec_t *) ev->data);
}

ngx_rtmp_exec_run(&en);

if (ngx_rtmp_exec_filter(s, en->conf) == NGX_OK) {
ngx_rtmp_exec_run(en);
}

All functions that call ngx_rtmp_exec_run are also static void functions so they can't send that value further up and it it's not convinient thing to do.

ngx_rtmp_exec_run prints all required debug data to logs and we won't lose anything if we remove return NGX_ERROR or NGX_OK values and SAST tools will stop triggering on those.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant