# Use of uninitialized value of in req_parsebody method of lua_request.c

Uninitialized `data` pointer in mod_lua's req_parsebody passed to strstr when request body is empty, crashing httpd via crafted multipart POST.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by (vendor credit): Chamal De Silva
- Found by: chamal
- Disclosed: 2022-03-17
- CVE: CVE-2022-22719
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1514863
- Library page: https://bugbountylibrary.com/r/h1%3A1514863
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium technique:source-review vuln:dos vuln:memory-corruption

**Target:** mod_lua r:parsebody multipart body parser
**Root cause:** `const char *data` in req_parsebody is not initialized; when lua_read_body returns OK without setting data (empty body), the uninitialized pointer is passed to strstr, causing an invalid read.
**Steps:**
1. Build httpd with `./configure --enable-lua=shared` and load mod_lua, mapping `*.lua` to lua-script handler.
2. Place a Lua script in htdocs.
3. Start httpd in single-worker debug mode: `./httpd -X`.
4. Send `curl -v -X POST -H 'content-type: multipart/form-data;boundary=-' http://127.0.0.1/test.lua` with no body.
5. httpd segfaults in strstr on the uninitialized pointer (0x1 on 64-bit builds).
**How found:** Code review of req_parsebody noticed `data` declared without initialization and passed to lua_read_body; hypothesized that an empty body leaves it unset, then confirmed via crash, also comparing 64-bit (0x1) vs 32-bit (valid address) behavior.
**Exploitation:** Attacker sends an empty-body multipart POST to a Lua-handled endpoint; the uninitialized pointer dereference crashes the worker process, yielding denial of service.
**Insight:** When auditing C body-parsing wrappers, check whether out-params from read functions are guaranteed set on all return paths; empty/zero-length bodies are the classic trigger for uninitialized-pointer dereferences.