CERBERUS/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-08-29 13:31:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Resolver: fixed use-after-free memory access.

Browse source 
In 954867a2f0a6, we switched to using resolver node as the
timer event data, so make sure we do not free resolver node
memory until the corresponding timer is deleted.
This commit is contained in:
Ruslan Ermilov 2014-11-20 15:24:40 +03:00
parent 96a62f1396
commit d4b7b74686
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/core/ngx_resolver.c
View file

@ -1568,8 +1568,6 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last,
ngx_rbtree_delete(&r->name_rbtree, &rn->node);
ngx_resolver_free_node(r, rn);
/* unlock name mutex */
while (next) {
@ -1580,6 +1578,8 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last,
ctx->handler(ctx);
}
ngx_resolver_free_node(r, rn);
return;
}
@ -2143,8 +2143,6 @@ valid:
ngx_rbtree_delete(tree, &rn->node);
ngx_resolver_free_node(r, rn);
/* unlock addr mutex */
while (next) {
@ -2155,6 +2153,8 @@ valid:
ctx->handler(ctx);
}
ngx_resolver_free_node(r, rn);
return;
}