CERBERUS/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-06-28 21:02:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

HTTP/3: allocate insert buffer from connection pool

Browse source 
Previously, it was allocated from the encoder stream pool.  This could
lead to use-after-free if the stream was closed and another encoder
stream was opened.

Reported by Trung Nguyen (@everping) of CyStack.
This commit is contained in:
Roman Arutyunyan 2026-05-19 15:46:31 +04:00 • committed by Roman Arutyunyan
parent 875750a4f7
commit ceccdbd2ee
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/http/v3/ngx_http_v3_table.c
View file

@ -168,7 +168,7 @@ ngx_http_v3_get_insert_buffer(ngx_connection_t *c)
if (dt->insert_buffer == NULL) {
h3scf = ngx_http_v3_get_module_srv_conf(c, ngx_http_v3_module);
dt->insert_buffer = ngx_create_temp_buf(c->pool,
dt->insert_buffer = ngx_create_temp_buf(c->quic->parent->pool,
h3scf->max_table_capacity);
if (dt->insert_buffer == NULL) {
return NULL;