From 4cd1dd28ddd91a15720febc491917da5ba16dbe6 Mon Sep 17 00:00:00 2001 From: Sergey Kandaurov Date: Tue, 10 Sep 2019 15:42:34 +0300 Subject: [PATCH] Resolver: fixed possible use-after-free while resolving PTR. Previously, if a response to the PTR request was cached, and ngx_resolver_dup() failed to allocate memory for the resulting name, then the original node was freed but left in expire_queue. A subsequent address resolving would end up in a use-after-free memory access of the node either in ngx_resolver_expire() or ngx_resolver_process_ptr(), when accessing it through expire_queue. The fix is to leave the resolver node intact. --- src/core/ngx_resolver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/core/ngx_resolver.c b/src/core/ngx_resolver.c index 593645d5d..e51712c0a 100644 --- a/src/core/ngx_resolver.c +++ b/src/core/ngx_resolver.c @@ -972,7 +972,8 @@ ngx_resolve_addr(ngx_resolver_ctx_t *ctx) name = ngx_resolver_dup(r, rn->name, rn->nlen); if (name == NULL) { - goto failed; + ngx_resolver_free(r, ctx); + return NGX_ERROR; } ctx->name.len = rn->nlen;