[Mod-security-developers] simple GET request cause ModSecurity nginx crash

[yorkng z. <yor...@gm...>]

hello all,
i'm testing ModSecurity nginx at ubuntu 12.04, nginx version 1.1.20
when i use curl like this: curl http://localhost/secret, then the nginx
worker process crash. i use gdb debug it, trouble spots is here

2.7-iis-nginx/nginx/modsecurity/ngx_http_modsecurity_module.c
----------------------------------------
392    ngx_http_read_request_body(req, ngx_http_dummy_payload_hander);
393    *ngx_log_error(NGX_LOG_INFO, req->connection->log, 0, "request body:
%s", req->request_body->bufs);*
394
395    if(status == DECLIEND)

----------------------------------------

*when GET request have no body,  the req->request_body->bufs is undefined,
like this:*
-----------------------------------------
Starting program: /opt/modsec-2.7-iis-nginx/sbin/nginx
[Thread debugging using libthread_db enabled]

Breakpoint 1, ngx_http_modsecurity_access_handler (req=0x942100)
    at
/home/yorkng/project/svn/nginxsec/branch/nsafe/src/addon/2.7-iis-nginx/nginx/modsecurity/ngx_http_modsecurity_module.c:392
warning: Source file is more recent than executable.
392       ngx_http_read_request_body(req, ngx_http_dummy_payload_handler);
(gdb) p req->request_body->bufs
Cannot access memory at address 0x8
(gdb)
------------------------------------------

my resolve patch is bellow:*

*--- nginx/modsecurity/ngx_http_modsecurity_module.c     (revision 2018)
+++ nginx/modsecurity/ngx_http_modsecurity_module.c     (working copy)
@@ -390,19 +390,25 @@
   ngx_log_error(NGX_LOG_INFO, req->connection->log, 0, "status: %d",
status);

   ngx_http_read_request_body(req, ngx_http_dummy_payload_handler);
-  ngx_log_error(NGX_LOG_INFO, req->connection->log, 0, "request body: %s",
req->request_body->bufs);
+  if (req->headers_in.content_length) {
+    ngx_log_error(NGX_LOG_INFO, req->connection->log, 0, "request body:
%s", req->request_body->bufs);
+  }
+  else {
+    ngx_log_error(NGX_LOG_INFO, req->connection->log, 0, "request body: ");
+  }

   if(status == DECLINED)
   {*
*