Mercurial > hg > nginx
changeset 6238:8c6e71722aff
Added protection against r->main->count overflow by subrequests.
This overflow has become possible after the change in 06e850859a26,
since concurrent subrequests are not limited now and each of them is
counted in r->main->count.
author | Valentin Bartenev <vbart@nginx.com> |
---|---|
date | Mon, 31 Aug 2015 23:25:16 +0300 |
parents | 06e850859a26 |
children | 281863981d0b |
files | src/http/ngx_http_core_module.c src/http/ngx_http_request.h |
diffstat | 2 files changed, 11 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/src/http/ngx_http_core_module.c Sun Aug 23 21:03:32 2015 +0300 +++ b/src/http/ngx_http_core_module.c Mon Aug 31 23:25:16 2015 +0300 @@ -2433,6 +2433,16 @@ return NGX_ERROR; } + /* + * 1000 is reserved for other purposes. + */ + if (r->main->count >= 65535 - 1000) { + ngx_log_error(NGX_LOG_CRIT, r->connection->log, 0, + "request reference counter overflow " + "while processing \"%V\"", uri); + return NGX_ERROR; + } + sr = ngx_pcalloc(r->pool, sizeof(ngx_http_request_t)); if (sr == NULL) { return NGX_ERROR;