Author: mdounin
Date: 2012-10-30 11:14:24 +0000 (Tue, 30 Oct 2012)
New Revision: 4896
URL: http://trac.nginx.org/nginx/changeset/4896/nginx

Log:
Event pipe: fixed handling of buf_to_file data.

Input filter might free a buffer if there is no data in it, and in case
of first buffer (used for cache header and request header, aka p->buf_to_file)
this resulted in cache corruption. Buffer memory was reused to read upstream
response before headers were written to disk.

Fix is to avoid moving pointers in ngx_event_pipe_add_free_buf() to a buffer
start if we were asked to free a buffer used by p->buf_to_file.

This fixes occasional cache file corruption, usually resulted
in "cache file ... has md5 collision" alerts.

Reported by Anatoli Marinov.


Modified:
trunk/src/event/ngx_event_pipe.c
trunk/src/http/ngx_http_upstream.c

Modified: trunk/src/event/ngx_event_pipe.c
===================================================================
--- trunk/src/event/ngx_event_pipe.c 2012-10-30 11:09:38 UTC (rev 4895)
+++ trunk/src/event/ngx_event_pipe.c 2012-10-30 11:14:24 UTC (rev 4896)
@@ -946,8 +946,15 @@
return NGX_ERROR;
}

- b->pos = b->start;
- b->last = b->start;
+ if (p->buf_to_file && b->start == p->buf_to_file->start) {
+ b->pos = p->buf_to_file->last;
+ b->last = p->buf_to_file->last;
+
+ } else {
+ b->pos = b->start;
+ b->last = b->start;
+ }
+
b->shadow = NULL;

cl->buf = b;

Modified: trunk/src/http/ngx_http_upstream.c
===================================================================
--- trunk/src/http/ngx_http_upstream.c 2012-10-30 11:09:38 UTC (rev 4895)
+++ trunk/src/http/ngx_http_upstream.c 2012-10-30 11:14:24 UTC (rev 4896)
@@ -2287,6 +2287,7 @@
return;
}

+ p->buf_to_file->start = u->buffer.start;
p->buf_to_file->pos = u->buffer.start;
p->buf_to_file->last = u->buffer.pos;
p->buf_to_file->temporary = 1;

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel