Hello!

On Mon, Sep 28, 2015 at 04:03:32PM +1000, Henry H wrote:

> Hi everyone,
>
> I just happened to find a bug in ngx_palloc,
>
> m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);
>
> After 'm' is aligned, it might bigger than p->d.end. So the following
> statement will be wrong:
>
> if ((size_t) (p->d.end - m) >= size)
>
> It should be changed to:
> if ( (m<p->d.end) && ((size_t) (p->d.end - m) >= size))

The problem here can only happen if p->d.end is not properly
aligned. This is not something expected to happen with correct
use of the pool allocation interface. See here for further
details:

https://trac.nginx.org/nginx/ticket/686

--
Maxim Dounin
http://nginx.org/

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel