diff options
| author | Valentin Bartenev <vbart@nginx.com> | 2013-02-23 13:23:48 +0000 |
|---|---|---|
| committer | Valentin Bartenev <vbart@nginx.com> | 2013-02-23 13:23:48 +0000 |
| commit | f1d5d03eee7917430c44c9ee8dcaba4efbb79cab (patch) | |
| tree | 2f9a9d2041770269211482f5c4261e631d30d941 /src/http/ngx_http_request.c | |
| parent | 890ee444cafb9dcce387bd0814c2996a60ecf10e (diff) | |
| download | nginx-f1d5d03eee7917430c44c9ee8dcaba4efbb79cab.tar.gz nginx-f1d5d03eee7917430c44c9ee8dcaba4efbb79cab.zip | |
Fixed potential segfault in ngx_http_keepalive_handler().
In case of error in the read event handling we close a connection
by calling ngx_http_close_connection(), that also destroys connection
pool. Thereafter, an attempt to free a buffer (added in r4892) that
was allocated from the pool could cause SIGSEGV and is meaningless
as well (the buffer already freed with the pool).
Diffstat (limited to 'src/http/ngx_http_request.c')
| -rw-r--r-- | src/http/ngx_http_request.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index 763e7bf11..5dc6942b0 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -2758,6 +2758,7 @@ ngx_http_keepalive_handler(ngx_event_t *rev) if (n == NGX_AGAIN) { if (ngx_handle_read_event(rev, 0) != NGX_OK) { ngx_http_close_connection(c); + return; } /* |