]> git.kaiwu.me - nginx.git/commit
Resolver: fixed possible use-after-free while resolving PTR.
authorSergey Kandaurov <pluknet@nginx.com>
Tue, 10 Sep 2019 12:42:34 +0000 (15:42 +0300)
committerSergey Kandaurov <pluknet@nginx.com>
Tue, 10 Sep 2019 12:42:34 +0000 (15:42 +0300)
commit4cd1dd28ddd91a15720febc491917da5ba16dbe6
treedb8f12c6c3f831fcfd3b1b8f219434f87090a3f1
parentc3f8098712d16e17a6577e203a8c0dc76331a1ee
Resolver: fixed possible use-after-free while resolving PTR.

Previously, if a response to the PTR request was cached, and ngx_resolver_dup()
failed to allocate memory for the resulting name, then the original node was
freed but left in expire_queue.  A subsequent address resolving would end up
in a use-after-free memory access of the node either in ngx_resolver_expire()
or ngx_resolver_process_ptr(), when accessing it through expire_queue.

The fix is to leave the resolver node intact.
src/core/ngx_resolver.c