mirror of
https://github.com/nginx/nginx.git
synced 2024-12-15 05:09:06 +08:00
4cd1dd28dd
Previously, if a response to the PTR request was cached, and ngx_resolver_dup() failed to allocate memory for the resulting name, then the original node was freed but left in expire_queue. A subsequent address resolving would end up in a use-after-free memory access of the node either in ngx_resolver_expire() or ngx_resolver_process_ptr(), when accessing it through expire_queue. The fix is to leave the resolver node intact. |
||
|---|---|---|
| .. | ||
| core | ||
| event | ||
| http | ||
| misc | ||
| os | ||
| stream | ||