Author: ru
Date: 2012-06-18 12:30:45 +0000 (Mon, 18 Jun 2012)
New Revision: 4684
URL: http://trac.nginx.org/nginx/changeset/4684/nginx

Log:
Fixed crash in ngx_resolver_cleanup_tree().

If sending a DNS request fails with an error (e.g., when mistakenly trying
to send it to a local IP broadcast), such a request is not deleted if there
are clients waiting on it. However, it was still erroneously removed from
the queue. Later ngx_resolver_cleanup_tree() attempted to remove it from
the queue again that resulted in a NULL pointer dereference.


Modified:
trunk/src/core/ngx_resolver.c

Modified: trunk/src/core/ngx_resolver.c
===================================================================
--- trunk/src/core/ngx_resolver.c 2012-06-18 11:07:44 UTC (rev 4683)
+++ trunk/src/core/ngx_resolver.c 2012-06-18 12:30:45 UTC (rev 4684)
@@ -977,12 +977,11 @@

if (rn->waiting) {

- if (ngx_resolver_send_query(r, rn) == NGX_OK) {
+ (void) ngx_resolver_send_query(r, rn);

- rn->expire = now + r->resend_timeout;
+ rn->expire = now + r->resend_timeout;

- ngx_queue_insert_head(queue, &rn->queue);
- }
+ ngx_queue_insert_head(queue, q);

continue;
}

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel