Mercurial > hg > nginx
changeset 6452:6be7e59fdd2c
Core: moved logging before freeing large blocks of pool.
This fixes use-after-free memory access with enabled debug log
when pool->log is allocated as a large block.
author | Valentin Bartenev <vbart@nginx.com> |
---|---|
date | Wed, 23 Mar 2016 17:44:04 +0300 |
parents | 155871d773cc |
children | 12248fe20689 |
files | src/core/ngx_palloc.c |
diffstat | 1 files changed, 10 insertions(+), 9 deletions(-) [+] |
line wrap: on
line diff
--- a/src/core/ngx_palloc.c Tue Mar 22 16:58:38 2016 +0300 +++ b/src/core/ngx_palloc.c Wed Mar 23 17:44:04 2016 +0300 @@ -56,15 +56,6 @@ } } - for (l = pool->large; l; l = l->next) { - - ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, pool->log, 0, "free: %p", l->alloc); - - if (l->alloc) { - ngx_free(l->alloc); - } - } - #if (NGX_DEBUG) /* @@ -72,6 +63,10 @@ * so we cannot use this log while free()ing the pool */ + for (l = pool->large; l; l = l->next) { + ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, pool->log, 0, "free: %p", l->alloc); + } + for (p = pool, n = pool->d.next; /* void */; p = n, n = n->d.next) { ngx_log_debug2(NGX_LOG_DEBUG_ALLOC, pool->log, 0, "free: %p, unused: %uz", p, p->d.end - p->d.last); @@ -83,6 +78,12 @@ #endif + for (l = pool->large; l; l = l->next) { + if (l->alloc) { + ngx_free(l->alloc); + } + } + for (p = pool, n = pool->d.next; /* void */; p = n, n = n->d.next) { ngx_free(p);