commit df98bd6ee56ca0f63e389cb371b4ad57b8a06f8b
author Vladimir Homutov <vl@nginx.com> Fri Aug 24 12:19:37 2018 +0300
committer Vladimir Homutov <vl@nginx.com> Fri Aug 24 12:19:37 2018 +0300
tree 28c362ed003911389284eaa88c1a0b1f008af2ba
parent 6b671aa8cf45fc0883724ac2fac054ac5d72476a

Upstream: fixed request chain traversal (ticket #1618).

The problem does not manifest itself currently, because in case of
non-buffered reading, chain link created by u->create_request method
consists of a single element.

Found by PVS-Studio.

src/http/ngx_http_upstream.c

diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
index 605ae34..6901941 100644
--- a/src/http/ngx_http_upstream.c
+++ b/src/http/ngx_http_upstream.c
@@ -2135,7 +2135,7 @@
         out = u->request_bufs;
 
         if (r->request_body->bufs) {
-            for (cl = out; cl->next; cl = out->next) { /* void */ }
+            for (cl = out; cl->next; cl = cl->next) { /* void */ }
             cl->next = r->request_body->bufs;
             r->request_body->bufs = NULL;
         }