~titusx/nginx/mainline

Viewing all changes in revision 6609.

  • Committer: Sergey Kandaurov
  • Date: 2019-09-10 12:42:34 UTC
  • Revision ID: git-v1:4cd1dd28ddd91a15720febc491917da5ba16dbe6
Resolver: fixed possible use-after-free while resolving PTR.

Previously, if a response to the PTR request was cached, and ngx_resolver_dup()
failed to allocate memory for the resulting name, then the original node was
freed but left in expire_queue.  A subsequent address resolving would end up
in a use-after-free memory access of the node either in ngx_resolver_expire()
or ngx_resolver_process_ptr(), when accessing it through expire_queue.

The fix is to leave the resolver node intact.

expand all expand all

Show diffs side-by-side

added added

removed removed

Lines of Context: