details: http://hg.nginx.org/nginx/rev/27559d4a5151
branches:
changeset: 7391:27559d4a5151
user: Vladimir Homutov <vl@nginx.com>
date: Wed Nov 07 13:22:14 2018 +0300
description:
Stream: fixed possible use of a freed connection.

The session handler may result in session termination, thus a connection
pool (from which c->udp was allocated) may be destroyed.

diffstat:

src/event/ngx_event_udp.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)

diffs (24 lines):

diff -r 2e7c4c3b0644 -r 27559d4a5151 src/event/ngx_event_udp.c
--- a/src/event/ngx_event_udp.c Tue Nov 13 14:42:47 2018 +0300
+++ b/src/event/ngx_event_udp.c Wed Nov 07 13:22:14 2018 +0300
@@ -261,7 +261,10 @@ ngx_event_recvmsg(ngx_event_t *ev)

rev->handler(rev);

- c->udp->buffer = NULL;
+ if (c->udp) {
+ c->udp->buffer = NULL;
+ }
+
rev->ready = 0;

goto next;
@@ -561,6 +564,8 @@ ngx_delete_udp_connection(void *data)
ngx_connection_t *c = data;

ngx_rbtree_delete(&c->listening->rbtree, &c->udp->node);
+
+ c->udp = NULL;
}


_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel