Welcome! Log In Create A New Profile

Advanced

Re: [BUG] New memory invalid read regression in resolver since nginx 1.7.5

Yichun Zhang (agentzh)
September 30, 2014 06:52PM
Hello!

On Tue, Sep 30, 2014 at 3:10 PM, Yichun Zhang (agentzh) wrote:
> ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ev->log, 0,
> "event timer del: %d: %M",
> ngx_event_ident(ev->data), ev->timer.key);
>

There is another issue here: it seems that ngx_event_ident() assumes
ev->data is an ngx_connection_t pointer:

#define ngx_event_ident(p) ((ngx_connection_t *) (p))->fd

But in fact, ev->data can point to any thing. Maybe it makes more
sense to just output the pointer value of ev->data here?

How about the following patch?

# HG changeset patch
# User Yichun Zhang <agentzh@gmail.com>
# Date 1412117428 25200
# Tue Sep 30 15:50:28 2014 -0700
# Node ID 1ff0f68d9376e3d184d65814a6372856bf65cfcd
# Parent a215d9021f137b9e2d4f69c37c7f992a2bef12c6
Event: ngx_event_ident should not assume ev->data to be an ngx_connection_t.

This change also fixes an invalid memory read in the resolver since 1.7.5
when --with-debug is used in the build.

diff -r a215d9021f13 -r 1ff0f68d9376 src/event/ngx_event.h
--- a/src/event/ngx_event.h Tue Sep 30 17:20:33 2014 +0400
+++ b/src/event/ngx_event.h Tue Sep 30 15:50:28 2014 -0700
@@ -526,7 +526,7 @@ ngx_int_t ngx_send_lowat(ngx_connection_


/* used in ngx_log_debugX() */
-#define ngx_event_ident(p) ((ngx_connection_t *) (p))->fd
+#define ngx_event_ident(p) (p)


#include <ngx_event_timer.h>
diff -r a215d9021f13 -r 1ff0f68d9376 src/event/ngx_event_timer.c
--- a/src/event/ngx_event_timer.c Tue Sep 30 17:20:33 2014 +0400
+++ b/src/event/ngx_event_timer.c Tue Sep 30 15:50:28 2014 -0700
@@ -99,7 +99,7 @@ ngx_event_expire_timers(void)
ev = (ngx_event_t *) ((char *) node -
offsetof(ngx_event_t, timer));

ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ev->log, 0,
- "event timer del: %d: %M",
+ "event timer del: %p: %M",
ngx_event_ident(ev->data), ev->timer.key);

ngx_rbtree_delete(&ngx_event_timer_rbtree, &ev->timer);
diff -r a215d9021f13 -r 1ff0f68d9376 src/event/ngx_event_timer.h
--- a/src/event/ngx_event_timer.h Tue Sep 30 17:20:33 2014 +0400
+++ b/src/event/ngx_event_timer.h Tue Sep 30 15:50:28 2014 -0700
@@ -36,7 +36,7 @@ static ngx_inline void
ngx_event_del_timer(ngx_event_t *ev)
{
ngx_log_debug2(NGX_LOG_DEBUG_EVENT, ev->log, 0,
- "event timer del: %d: %M",
+ "event timer del: %p: %M",
ngx_event_ident(ev->data), ev->timer.key);

ngx_mutex_lock(ngx_event_timer_mutex);
@@ -75,7 +75,7 @@ ngx_event_add_timer(ngx_event_t *ev, ngx

if (ngx_abs(diff) < NGX_TIMER_LAZY_DELAY) {
ngx_log_debug3(NGX_LOG_DEBUG_EVENT, ev->log, 0,
- "event timer: %d, old: %M, new: %M",
+ "event timer: %p, old: %M, new: %M",
ngx_event_ident(ev->data), ev->timer.key, key);
return;
}
@@ -86,7 +86,7 @@ ngx_event_add_timer(ngx_event_t *ev, ngx
ev->timer.key = key;

ngx_log_debug3(NGX_LOG_DEBUG_EVENT, ev->log, 0,
- "event timer add: %d: %M:%M",
+ "event timer add: %p: %M:%M",
ngx_event_ident(ev->data), timer, ev->timer.key);

ngx_mutex_lock(ngx_event_timer_mutex);
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

[BUG] New memory invalid read regression in resolver since nginx 1.7.5

Yichun Zhang (agentzh) 1266 September 30, 2014 06:12PM

Re: [BUG] New memory invalid read regression in resolver since nginx 1.7.5

Yichun Zhang (agentzh) 350 September 30, 2014 06:52PM

Re: [BUG] New memory invalid read regression in resolver since nginx 1.7.5

Maxim Dounin 361 September 30, 2014 08:38PM

Re: [BUG] New memory invalid read regression in resolver since nginx 1.7.5

Yichun Zhang (agentzh) 399 October 01, 2014 03:38PM

Re: [BUG] New memory invalid read regression in resolver since nginx 1.7.5

Maxim Dounin 394 September 30, 2014 08:34PM

Re: [BUG] New memory invalid read regression in resolver since nginx 1.7.5

Ruslan Ermilov 353 November 18, 2014 05:26AM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 188
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready