Missing NULL checks after ngx_array_create() / ngx_array_push() may lead to NULL dereference

[mishatarsov21e3]

Hello!

During static analysis of ngx_http_auth_digest_module using the SVACE static analyzer, we found several places where memory allocation helper functions may return NULL, but their return values are used without validation.

The issues are similar to patterns already handled in many other parts of nginx code where allocation results are checked before dereferencing.

1. ngx_http_auth_digest_module.c: unchecked ngx_array_push() result

Markers:

• ngx_http_auth_digest_module.c:1298
• ngx_http_auth_digest_module.c:1237

SVACE warning:

Return value of function ngx_array_push is dereferenced without checking for NULL.

Problematic code

ngx_rbtree_node_t **dropnode =
    ngx_array_push(ngx_http_auth_digest_cleanup_list);

dropnode[0] = node;

ngx_array_push() may return NULL if the array needs to grow and memory allocation fails.

In both tree pruning functions, the returned pointer is immediately dereferenced:

dropnode[0] = node;

without checking whether allocation succeeded.

Suggested fix

ngx_rbtree_node_t **dropnode =
    ngx_array_push(ngx_http_auth_digest_cleanup_list);

if (dropnode == NULL) {
    ngx_log_error(NGX_LOG_ERR, log, 0,
                  "auth_digest ran out of cleanup space");
    return;
}

dropnode[0] = node;

---

2. ngx_http_subs_filter_module.c: unchecked ngx_array_create() result

Marker:

• ngx_http_subs_filter_module.c:306

SVACE warning:

Return value of function ngx_array_create is dereferenced without checking for NULL.

Problematic code

ctx->sub_pairs = ngx_array_create(
    r->pool,
    slcf->sub_pairs->nelts,
    sizeof(sub_pair_t));

if (slcf->sub_pairs == NULL) {
    return NGX_ERROR;
}

The result of ngx_array_create() is stored in ctx->sub_pairs, but the code checks slcf->sub_pairs instead.

If ngx_array_create() returns NULL, the error is not detected and ctx->sub_pairs is later used:

dst_pair = ngx_array_push(ctx->sub_pairs);

which may lead to a NULL pointer dereference.

Suggested fix

ctx->sub_pairs = ngx_array_create(
    r->pool,
    slcf->sub_pairs->nelts,
    sizeof(sub_pair_t));

if (ctx->sub_pairs == NULL) {
    return NGX_ERROR;
}

---

Summary

In both cases, the root cause is the same:

• memory allocation helper functions (ngx_array_push() and ngx_array_create()) may fail and return NULL;
• the returned value is subsequently used without validation;
• this can potentially result in a NULL pointer dereference under low-memory conditions.

Most usages of these functions throughout nginx and related modules validate the returned pointer before dereferencing it, so these locations appear inconsistent with the common error-handling pattern.

Found by Linux Verification Center (linuxtesting.org) with SVACE.