Fijxu/nginx-quic
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Resolver: fixed use-after-free memory access.

Browse source 
In 954867a2f0a6, we switched to using resolver node as the
timer event data, so make sure we do not free resolver node
memory until the corresponding timer is deleted.
This commit is contained in:
Ruslan Ermilov 2014-11-20 15:24:40 +03:00
parent ed7361ebc3
commit 19c855aa1a
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/core/ngx_resolver.c
View file

@ -1568,8 +1568,6 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last,
ngx_rbtree_delete(&r->name_rbtree, &rn->node);
ngx_resolver_free_node(r, rn);
/* unlock name mutex */
while (next) {
@ -1580,6 +1578,8 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last,
ctx->handler(ctx);
}
ngx_resolver_free_node(r, rn);
return;
}
@ -2143,8 +2143,6 @@ valid:
ngx_rbtree_delete(tree, &rn->node);
ngx_resolver_free_node(r, rn);
/* unlock addr mutex */
while (next) {
@ -2155,6 +2153,8 @@ valid:
ctx->handler(ctx);
}
ngx_resolver_free_node(r, rn);
return;
}