mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-07-30 10:06:16 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Resolver: fixed use-after-free memory access.

Browse Source 
In 954867a2f0a6, we switched to using resolver node as the
timer event data, so make sure we do not free resolver node
memory until the corresponding timer is deleted.
This commit is contained in:
Ruslan Ermilov 2014-11-20 15:24:40 +03:00
parent de557628d3
commit 1f9564223b
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/core/ngx_resolver.c
View File

@ -1568,8 +1568,6 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last,
ngx_rbtree_delete(&r->name_rbtree, &rn->node);
ngx_resolver_free_node(r, rn);
/* unlock name mutex */
while (next) {
@ -1580,6 +1578,8 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last,
ctx->handler(ctx);
}
ngx_resolver_free_node(r, rn);
return;
}
@ -2143,8 +2143,6 @@ valid:
ngx_rbtree_delete(tree, &rn->node);
ngx_resolver_free_node(r, rn);
/* unlock addr mutex */
while (next) {
@ -2155,6 +2153,8 @@ valid:
ctx->handler(ctx);
}
ngx_resolver_free_node(r, rn);
return;
}