Mercurial > hg > nginx
changeset 7566:571383f75a9a
Resolver: fixed possible use-after-free while resolving PTR.
Previously, if a response to the PTR request was cached, and ngx_resolver_dup()
failed to allocate memory for the resulting name, then the original node was
freed but left in expire_queue. A subsequent address resolving would end up
in a use-after-free memory access of the node either in ngx_resolver_expire()
or ngx_resolver_process_ptr(), when accessing it through expire_queue.
The fix is to leave the resolver node intact.
author | Sergey Kandaurov <pluknet@nginx.com> |
---|---|
date | Tue, 10 Sep 2019 15:42:34 +0300 |
parents | fd6dcc6f8a49 |
children | ef7ee19776db |
files | src/core/ngx_resolver.c |
diffstat | 1 files changed, 2 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/src/core/ngx_resolver.c Tue Sep 10 15:33:38 2019 +0300 +++ b/src/core/ngx_resolver.c Tue Sep 10 15:42:34 2019 +0300 @@ -972,7 +972,8 @@ name = ngx_resolver_dup(r, rn->name, rn->nlen); if (name == NULL) { - goto failed; + ngx_resolver_free(r, ctx); + return NGX_ERROR; } ctx->name.len = rn->nlen;