Hi everyone,

I just happened to find a bug in ngx_palloc,

m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);

After 'm' is aligned, it might bigger than p->d.end. So the following
statement will be wrong:

if ((size_t) (p->d.end - m) >= size)

It should be changed to:
if ( (m<p->d.end) && ((size_t) (p->d.end - m) >= size))

Regards,
Henry

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel