Limit req: fix of rbtree node insertion on hash collisions.

The rbtree used in ngx_http_limit_req_module has two level of keys, the top is
hash, and the next is the value string itself. However, when inserting a new
node, only hash has been set, while the value string has been left empty.

The bug was introduced in r4419 (1.1.14).

Found by Charles Chen.

diff --git a/src/http/modules/ngx_http_limit_req_module.c b/src/http/modules/ngx_http_limit_req_module.c
index 3f9910e7178ea9af1179b5f563c2782b73129967..31a8b987a651631058e500d6e7d70c381a4979c8 100644 (file)
--- a/src/http/modules/ngx_http_limit_req_module.c
+++ b/src/http/modules/ngx_http_limit_req_module.c
@@ -444,17 +444,17 @@ ngx_http_limit_req_lookup(ngx_http_limit_req_limit_t *limit, ngx_uint_t hash,
 
     node->key = hash;
 
-    ngx_rbtree_insert(&ctx->sh->rbtree, node);
-
     lr = (ngx_http_limit_req_node_t *) &node->color;
 
-    ngx_queue_insert_head(&ctx->sh->queue, &lr->queue);
-
     lr->len = (u_char) len;
     lr->excess = 0;
 
     ngx_memcpy(lr->data, data, len);
 
+    ngx_rbtree_insert(&ctx->sh->rbtree, node);
+
+    ngx_queue_insert_head(&ctx->sh->queue, &lr->queue);
+
     if (account) {
         lr->last = now;
         lr->count = 0;