diff options
| author | Valentin Bartenev <vbart@nginx.com> | 2014-01-15 17:16:38 +0400 |
|---|---|---|
| committer | Valentin Bartenev <vbart@nginx.com> | 2014-01-15 17:16:38 +0400 |
| commit | b2b43ca50f0bfdf31a600f61db28155f13382b22 (patch) | |
| tree | de69045504b6e0bbbc1971c225107c73e3a68092 /src | |
| parent | d143119e3cb939b69cb77d5bce6ac37f16e7c197 (diff) | |
| download | nginx-b2b43ca50f0bfdf31a600f61db28155f13382b22.tar.gz nginx-b2b43ca50f0bfdf31a600f61db28155f13382b22.zip | |
SPDY: fixed possible uninitialized memory access.
The frame->stream pointer should always be initialized for control frames since
the check against it can be performed in ngx_http_spdy_filter_cleanup().
Diffstat (limited to 'src')
| -rw-r--r-- | src/http/ngx_http_spdy.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c index e57619654..01b8e284e 100644 --- a/src/http/ngx_http_spdy.c +++ b/src/http/ngx_http_spdy.c @@ -1633,8 +1633,8 @@ ngx_http_spdy_send_settings(ngx_http_spdy_connection_t *sc) frame->first = cl; frame->last = cl; frame->handler = ngx_http_spdy_settings_frame_handler; -#if (NGX_DEBUG) frame->stream = NULL; +#if (NGX_DEBUG) frame->size = NGX_SPDY_FRAME_HEADER_SIZE + NGX_SPDY_SETTINGS_NUM_SIZE + NGX_SPDY_SETTINGS_PAIR_SIZE; @@ -1722,6 +1722,7 @@ ngx_http_spdy_get_ctl_frame(ngx_http_spdy_connection_t *sc, size_t size, frame->first = cl; frame->last = cl; frame->handler = ngx_http_spdy_ctl_frame_handler; + frame->stream = NULL; } frame->free = NULL; @@ -1733,7 +1734,6 @@ ngx_http_spdy_get_ctl_frame(ngx_http_spdy_connection_t *sc, size_t size, return NULL; } - frame->stream = NULL; frame->size = size; #endif |