mirror of
https://github.com/nginx/nginx.git
synced 2026-06-25 03:16:37 +00:00
Resolver: fixed possible use-after-free while resolving PTR.
Previously, if a response to the PTR request was cached, and ngx_resolver_dup() failed to allocate memory for the resulting name, then the original node was freed but left in expire_queue. A subsequent address resolving would end up in a use-after-free memory access of the node either in ngx_resolver_expire() or ngx_resolver_process_ptr(), when accessing it through expire_queue. The fix is to leave the resolver node intact.
This commit is contained in:
parent
c3f8098712
commit
4cd1dd28dd
1 changed files with 2 additions and 1 deletions
|
|
@ -972,7 +972,8 @@ ngx_resolve_addr(ngx_resolver_ctx_t *ctx)
|
|||
|
||||
name = ngx_resolver_dup(r, rn->name, rn->nlen);
|
||||
if (name == NULL) {
|
||||
goto failed;
|
||||
ngx_resolver_free(r, ctx);
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
ctx->name.len = rn->nlen;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue