diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2013-03-29 17:19:11 +0000 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2013-03-29 17:19:11 +0000 |
| commit | 07c3c53e00b49aa25451a38fdb0aadb875ff8432 (patch) | |
| tree | 6f9b766bcbacc4f5a8b02de6ddaacf27fdd86874 | |
| parent | e4010d888ffb07e12da2bdfecd9284871be27e52 (diff) | |
| download | nginx-07c3c53e00b49aa25451a38fdb0aadb875ff8432.tar.gz | |
Merge of r5083: fixed potential segfault in keepalive handler.
Fixed potential segfault in ngx_http_keepalive_handler().
In case of error in the read event handling we close a connection
by calling ngx_http_close_connection(), that also destroys connection
pool. Thereafter, an attempt to free a buffer (added in r4892) that
was allocated from the pool could cause SIGSEGV and is meaningless
as well (the buffer already freed with the pool).
| -rw-r--r-- | src/http/ngx_http_request.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index ee00fd3af..bac35fcc9 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -2743,6 +2743,7 @@ ngx_http_keepalive_handler(ngx_event_t *rev) if (n == NGX_AGAIN) { if (ngx_handle_read_event(rev, 0) != NGX_OK) { ngx_http_close_connection(c); + return; } /* |