mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-06-08 02:02:38 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixed overflow if ngx_slab_alloc() is called with very big "size" argument.

Browse Source
This commit is contained in:
Ruslan Ermilov 2012-08-30 15:09:21 +00:00
parent d469482cda
commit 9d6d33a561
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/core/ngx_slab.c
View File

@ -162,8 +162,8 @@ ngx_slab_alloc_locked(ngx_slab_pool_t *pool, size_t size)
ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0, ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0,
"slab alloc: %uz", size); "slab alloc: %uz", size);
page = ngx_slab_alloc_pages(pool, (size + ngx_pagesize - 1) page = ngx_slab_alloc_pages(pool, (size >> ngx_pagesize_shift)
>> ngx_pagesize_shift); + ((size % ngx_pagesize) ? 1 : 0));
if (page) { if (page) {
p = (page - pool->pages) << ngx_pagesize_shift; p = (page - pool->pages) << ngx_pagesize_shift;
p += (uintptr_t) pool->start; p += (uintptr_t) pool->start;