mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-12-03 21:18:59 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Resolver: fixed use-after-free memory access.

Browse Source 
In 954867a2f0a6, we switched to using resolver node as the
timer event data, so make sure we do not free resolver node
memory until the corresponding timer is deleted.
This commit is contained in:
Ruslan Ermilov 2014-11-20 15:24:40 +03:00
parent 96a62f1396
commit d4b7b74686
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/core/ngx_resolver.c
View File

@ -1568,8 +1568,6 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last,
ngx_rbtree_delete(&r->name_rbtree, &rn->node); ngx_rbtree_delete(&r->name_rbtree, &rn->node);
ngx_resolver_free_node(r, rn);
/* unlock name mutex */ /* unlock name mutex */
while (next) { while (next) {
@ -1580,6 +1578,8 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last,
ctx->handler(ctx); ctx->handler(ctx);
} }
ngx_resolver_free_node(r, rn);
return; return;
} }
@ -2143,8 +2143,6 @@ valid:
ngx_rbtree_delete(tree, &rn->node); ngx_rbtree_delete(tree, &rn->node);
ngx_resolver_free_node(r, rn);
/* unlock addr mutex */ /* unlock addr mutex */
while (next) { while (next) {
@ -2155,6 +2153,8 @@ valid:
ctx->handler(ctx); ctx->handler(ctx);
} }
ngx_resolver_free_node(r, rn);
return; return;
} }