🐛 [Bug]: Next() and OverrideParam() dereference c.route without nil check

[pageton]

Bug Description

Next() and OverrideParam() access c.route.Handlers and c.route.Params without checking if c.route is nil. Other methods like Route() and IsMiddleware() properly guard against nil c.route.

How to Reproduce

Steps to reproduce the behavior:

1. Call Next() from a custom error handler or middleware that runs before routing
2. c.route is nil (router hasn't set it yet)
3. c.route.Handlers panics with nil pointer dereference

Affected Code

ctx.go:249-259 — Next():

func (c *DefaultCtx) Next() error {
    c.indexHandler++
    if c.indexHandler < len(c.route.Handlers) {  // PANIC if c.route is nil

ctx.go:419-442 — OverrideParam():

func (c *DefaultCtx) OverrideParam(name, value string) {
    if !c.Matched() {    // checks c.isMatched, NOT c.route != nil
        return
    }
    for i, param := range c.route.Params {  // PANIC if c.route is nil

Contrast with correct patterns

Route() at line 365 and IsMiddleware() at line 387 properly check:

if c.route == nil {  // correct nil guard
    return &Route{...}
}

Expected Behavior

func (c *DefaultCtx) Next() error {
    c.indexHandler++
    if c.route != nil && c.indexHandler < len(c.route.Handlers) {
        // ...
    }
}

func (c *DefaultCtx) OverrideParam(name, value string) {
    if c.route == nil {
        return
    }
    // ...
}

Fiber Version

v3 (latest main branch)

[ReneWerner87]

Thanks for the report. Closing as not reproducible.

Both call sites are safe in practice:

OverrideParam() - the !c.Matched() guard is sufficient. c.isMatched is only ever set to true in the router at the exact point where c.route is assigned a non-nil route (c.route = route immediately followed by c.isMatched = true). They are set together and reset together, so Matched() == true implies c.route != nil. There is no state in which the guard passes while c.route is nil.

Next() - Next() is only ever invoked from inside a handler, and the router assigns c.route before it invokes the first handler (c.route = route ... then route.Handlers[0](c)). User code therefore cannot reach Next() with a nil c.route. The states where c.route is nil (a freshly acquired ctx, a released ctx, the fasthttp error-handler fallback) never run user handlers that could call Next().

The nil guards on Route() and IsMiddleware() exist precisely because those methods are designed to be callable outside an active match (for example from a custom error handler); Next()/OverrideParam() are not. If you can share a reproduction that actually panics, we will gladly reopen.