bugfix: three latent bugs found in src code review

- ssl_certby: avoid double-free of name_chain after SSL_set_client_CA_list
  transfers ownership; clear it so the failed: path does not free it again.
- regex: PCRE1 ngx_stream_lua_regex_compile failed: path returned NGX_OK
  instead of NGX_ERROR, masking pcre_fullinfo() failure and leaving
  captures uninitialized (matches PCRE2 sibling now).
- output: fix 4-byte buffer overflow when a non-NULL lightuserdata is
  passed; the size pass reserves nothing for it but the copy pass wrote
  "null". Guard the copy with the same NULL check in both ngx.echo and
  copy_str_in_table.

Author: zhuizhuhaomeng

src/ngx_stream_lua_output.c

@@ -201,10 +201,16 @@ ngx_stream_lua_ngx_echo(lua_State *L, unsigned newline)
                 break;
 
             case LUA_TLIGHTUSERDATA:
-                *b->last++ = 'n';
-                *b->last++ = 'u';
-                *b->last++ = 'l';
-                *b->last++ = 'l';
+                /* must mirror the size pass above: only NULL lightuserdata
+                 * (ngx.null) reserves space for "null"; non-NULL reserves
+                 * nothing, so write nothing here to avoid overflowing the
+                 * buffer. */
+                if (lua_touserdata(L, i) == NULL) {
+                    *b->last++ = 'n';
+                    *b->last++ = 'u';
+                    *b->last++ = 'l';
+                    *b->last++ = 'l';
+                }
                 break;
 
             default:
@@ -426,10 +432,15 @@ ngx_stream_lua_copy_str_in_table(lua_State *L, int index, u_char *dst)
 
             case LUA_TLIGHTUSERDATA:
 
-                *dst++ = 'n';
-                *dst++ = 'u';
-                *dst++ = 'l';
-                *dst++ = 'l';
+                /* must mirror ngx_stream_lua_calc_strlen_in_table: only NULL
+                 * lightuserdata (ngx.null) reserves space for "null"; non-NULL
+                 * reserves nothing, so write nothing here. */
+                if (lua_touserdata(L, -1) == NULL) {
+                    *dst++ = 'n';
+                    *dst++ = 'u';
+                    *dst++ = 'l';
+                    *dst++ = 'l';
+                }
                 break;
 
             default:

src/ngx_stream_lua_regex.c

@@ -329,7 +329,7 @@ ngx_stream_lua_regex_compile(ngx_stream_lua_regex_compile_t *rc)
 
     rc->err.len = ngx_snprintf(rc->err.data, rc->err.len, p, &rc->pattern, n)
                   - rc->err.data;
-    return NGX_OK;
+    return NGX_ERROR;
 }
 #endif
 

src/ngx_stream_lua_ssl_certby.c

@@ -1666,8 +1666,13 @@ ngx_stream_lua_ffi_ssl_verify_client(ngx_stream_lua_request_t *r,
                 }
             }
 
-            /* clean subject name list, and set it for send to client */
+            /* clean subject name list, and set it for send to client.
+             * ownership of name_chain is transferred to ssl_conn here, so
+             * clear our reference to avoid a double-free on the failed: path
+             * if a later step (trusted_chain loop or set0_verify_cert_store)
+             * fails. */
             SSL_set_client_CA_list(ssl_conn, name_chain);
+            name_chain = NULL;
         }
 
         if (trusted_chain != NULL) {