[nginx] Gzip: fixed duplicate ngx_pfree() on ctx->preallocated.

[Maxim Dounin]

details:   http://freenginx.org/hg/nginx/rev/2dd3d84cfa0f
branches:  
changeset: 9562:2dd3d84cfa0f
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Sat Jun 20 05:49:19 2026 +0300
description:
Gzip: fixed duplicate ngx_pfree() on ctx->preallocated.

Previously, the gzip filter called ngx_pfree() on the ctx->preallocated
pointer in ngx_http_gzip_filter_deflate_end() when compression is
finished, but did not clear it.  As a result, ngx_pfree() might be
called again in the ngx_http_gzip_body_filter() error handling code path
if an error happened either in ngx_http_gzip_filter_deflate_end() during
allocation of a chain link, or anywhere in the next body filters when
sending the last part of the response.

Potentially, this might cause issues if the same address is used by a
large pool allocation in the next body filters (unlikely in practice
though, especially given that standard body filters running after the
gzip filter don't do any large pool allocations).

The fix is to clear ctx->preallocated after it is freed in
ngx_http_gzip_filter_deflate_end().

Reported by Evan Hellman,
https://github.com/freenginx/nginx/issues/25

diffstat:

 src/http/modules/ngx_http_gzip_filter_module.c |  1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diffs (11 lines):

diff --git a/src/http/modules/ngx_http_gzip_filter_module.c b/src/http/modules/ngx_http_gzip_filter_module.c
--- a/src/http/modules/ngx_http_gzip_filter_module.c
+++ b/src/http/modules/ngx_http_gzip_filter_module.c
@@ -902,6 +902,7 @@ ngx_http_gzip_filter_deflate_end(ngx_htt
     }
 
     ngx_pfree(r->pool, ctx->preallocated);
+    ctx->preallocated = NULL;
 
     cl = ngx_alloc_chain_link(r->pool);
     if (cl == NULL) {