The official NGINX Open Source repository.
Go to file
Maxim Dounin b5d0d7a232 Event pipe: fixed buffer loss in p->length case.
With previous code raw buffer might be lost if p->input_filter() was called
on a buffer without any data and used ngx_event_pipe_add_free_buf() to
return it to the free list.  This eventually might cause "all buffers busy"
problem, resulting in segmentation fault due to null pointer dereference in
ngx_event_pipe_write_chain_to_temp_file().

In ngx_event_pipe_add_free_buf() the buffer was added to the list start
due to pos == last, and then "p->free_raw_bufs = cl->next" in
ngx_event_pipe_read_upstream() dropped both chain links to the buffer
from the p->free_raw_bufs list.

Fix is to move "p->free_raw_bufs = cl->next" before calling the
p->input_filter().
2012-02-22 11:28:53 +00:00
auto Added openat()/fstatat(). 2012-02-13 16:13:21 +00:00
conf Added the HTTPS fastcgi_param to fastcgi.conf. 2011-12-25 19:15:56 +00:00
contrib nginx-0.3.55-RELEASE import 2006-07-28 15:16:17 +00:00
docs nginx-1.1.15-RELEASE 2012-02-15 13:26:06 +00:00
misc Update OpenSSL and PCRE used for win32 builds. 2012-01-30 13:47:03 +00:00
src Event pipe: fixed buffer loss in p->length case. 2012-02-22 11:28:53 +00:00
.hgtags release-1.1.15 tag 2012-02-15 13:26:27 +00:00