Mercurial > hg > nginx
changeset 4011:9d4cbb09ae8b
Upstream: properly allocate memory for tried flags.
Previous allocation only took into account number of non-backup servers, and
this caused memory corruption with many backup servers.
See report here:
http://mailman.nginx.org/pipermail/nginx/2011-May/026531.html
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Thu, 18 Aug 2011 17:04:52 +0000 |
parents | 74a93d3fdd85 |
children | bf452af6c1d2 |
files | src/http/ngx_http_upstream_round_robin.c |
diffstat | 1 files changed, 8 insertions(+), 3 deletions(-) [+] |
line wrap: on
line diff
--- a/src/http/ngx_http_upstream_round_robin.c Thu Aug 18 16:52:38 2011 +0000 +++ b/src/http/ngx_http_upstream_round_robin.c Thu Aug 18 17:04:52 2011 +0000 @@ -228,13 +228,18 @@ rrp->peers = us->peer.data; rrp->current = 0; - if (rrp->peers->number <= 8 * sizeof(uintptr_t)) { + n = rrp->peers->number; + + if (rrp->peers->next && rrp->peers->next->number > n) { + n = rrp->peers->next->number; + } + + if (n <= 8 * sizeof(uintptr_t)) { rrp->tried = &rrp->data; rrp->data = 0; } else { - n = (rrp->peers->number + (8 * sizeof(uintptr_t) - 1)) - / (8 * sizeof(uintptr_t)); + n = (n + (8 * sizeof(uintptr_t) - 1)) / (8 * sizeof(uintptr_t)); rrp->tried = ngx_pcalloc(r->pool, n * sizeof(uintptr_t)); if (rrp->tried == NULL) {