[nginx] Fixed r->main->blocked overflow with many subrequests.

[Maxim Dounin]

details:   http://freenginx.org/hg/nginx/rev/19f937a6a6bf
branches:  
changeset: 9595:19f937a6a6bf
user:      Maxim Dounin <mdounin at mdounin.ru>
date:      Tue Oct 27 07:54:59 2026 +0300
description:
Fixed r->main->blocked overflow with many subrequests.

Similarly to r->main->count overflow by subrequests as addressed by
6238:8c6e71722aff (which became possible after subrequest limiting
changes in 6237:06e850859a26), r->main->blocked might overflow if there
are multiple AIO operations.  This could result in a request being freed
prematurely, followed by accesses to already freed memory when an AIO
operation completes (known as CVE-2026-97205, though security impact is
questionable).

The fix is to use 16 bits for the r->main->blocked counter, so the
subrequest limit introduced in 6238:8c6e71722aff ensures that it does
not overflow.

See also:
https://github.com/nginx/nginx/commit/6adfc05ece48f92446383ec1f145446848694698

diffstat:

 src/http/ngx_http_request.h |  2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diffs (13 lines):

diff --git a/src/http/ngx_http_request.h b/src/http/ngx_http_request.h
--- a/src/http/ngx_http_request.h
+++ b/src/http/ngx_http_request.h
@@ -473,8 +473,8 @@ struct ngx_http_request_s {
     ngx_http_cleanup_t               *cleanup;
 
     unsigned                          count:16;
+    unsigned                          blocked:16;
     unsigned                          subrequests:8;
-    unsigned                          blocked:8;
 
     unsigned                          aio:1;