mirror of
https://github.com/nginx/nginx.git
synced 2026-09-27 09:36:28 +00:00
The official NGINX Open Source repository.
https://nginx.org/
content-cachehttphttp2http3httpsload-balancermail-proxy-servernginxquicreverse-proxysecuritytcp-proxy-servertlsudp-proxy-serverweb-server
With previous code raw buffer might be lost if p->input_filter() was called on a buffer without any data and used ngx_event_pipe_add_free_buf() to return it to the free list. This eventually might cause "all buffers busy" problem, resulting in segmentation fault due to null pointer dereference in ngx_event_pipe_write_chain_to_temp_file(). In ngx_event_pipe_add_free_buf() the buffer was added to the list start due to pos == last, and then "p->free_raw_bufs = cl->next" in ngx_event_pipe_read_upstream() dropped both chain links to the buffer from the p->free_raw_bufs list. Fix is to move "p->free_raw_bufs = cl->next" before calling the p->input_filter(). |
||
|---|---|---|
| auto | ||
| conf | ||
| contrib | ||
| docs | ||
| misc | ||
| src | ||
| .hgtags | ||