From: Ruslan Ermilov <ru@nginx.com>
Date: Mon, 18 Jun 2012 12:30:45 +0000 (+0000)
Subject: Fixed crash in ngx_resolver_cleanup_tree().
X-Git-Tag: release-1.3.2~20
X-Git-Url: http://www.kaiwu.me/postgresql/commit/static/gitweb.js?a=commitdiff_plain;h=da8bb22634e9cf5419b839c9ba7a359efc62c7b1;p=nginx.git

Fixed crash in ngx_resolver_cleanup_tree().

If sending a DNS request fails with an error (e.g., when mistakenly trying
to send it to a local IP broadcast), such a request is not deleted if there
are clients waiting on it.  However, it was still erroneously removed from
the queue.  Later ngx_resolver_cleanup_tree() attempted to remove it from
the queue again that resulted in a NULL pointer dereference.
---

diff --git a/src/core/ngx_resolver.c b/src/core/ngx_resolver.c
index 2b0e41a5e..53fbbf92a 100644
--- a/src/core/ngx_resolver.c
+++ b/src/core/ngx_resolver.c
@@ -977,12 +977,11 @@ ngx_resolver_resend(ngx_resolver_t *r, ngx_rbtree_t *tree, ngx_queue_t *queue)
 
         if (rn->waiting) {
 
-            if (ngx_resolver_send_query(r, rn) == NGX_OK) {
+            (void) ngx_resolver_send_query(r, rn);
 
-                rn->expire = now + r->resend_timeout;
+            rn->expire = now + r->resend_timeout;
 
-                ngx_queue_insert_head(queue, &rn->queue);
-            }
+            ngx_queue_insert_head(queue, q);
 
             continue;
         }