]> git.kaiwu.me - nginx.git/commitdiff
Slice filter: improved memory allocation error handling.
authorSergey Kandaurov <pluknet@nginx.com>
Thu, 27 Feb 2025 12:09:50 +0000 (16:09 +0400)
committerRoman Arutyunyan <arutyunyan.roman@gmail.com>
Mon, 10 Mar 2025 16:32:07 +0000 (19:32 +0300)
As uncovered by recent addition in slice.t, a partially initialized
context, coupled with HTTP 206 response from stub backend, might be
accessed in the next slice subrequest.

Found by bad memory allocator simulation.

src/http/modules/ngx_http_slice_filter_module.c

index 3b0bef629e55d1f3351fbfdcb9819ca6e2417c59..67dc14c8249d2b98fd09d3709b03fe9314a9af6a 100644 (file)
@@ -419,13 +419,13 @@ ngx_http_slice_range_variable(ngx_http_request_t *r,
             return NGX_ERROR;
         }
 
-        ngx_http_set_ctx(r, ctx, ngx_http_slice_filter_module);
-
         p = ngx_pnalloc(r->pool, sizeof("bytes=-") - 1 + 2 * NGX_OFF_T_LEN);
         if (p == NULL) {
             return NGX_ERROR;
         }
 
+        ngx_http_set_ctx(r, ctx, ngx_http_slice_filter_module);
+
         ctx->start = slcf->size * (ngx_http_slice_get_start(r) / slcf->size);
 
         ctx->range.data = p;