diff options
| author | NGINX team <nginx@nginx.org> | 2012-04-12 13:05:40 +0000 |
|---|---|---|
| committer | Jon Kolb <jon@b0g.us> | 2012-04-12 13:05:40 +0000 |
| commit | ed2df87c83d3a68ab2a395d4c2549dbe26e86ab0 (patch) | |
| tree | ff91c69d84d5e4b84a15a12b873c3cb2193fd481 /src/core/ngx_rbtree.c | |
| parent | 60a50f7b445d1ac18ea0b1ff140745b6844c6794 (diff) | |
| download | nginx-1.1.tar.gz | |
*) Security: specially crafted mp4 file might allow to overwrite memory
locations in a worker process if the ngx_http_mp4_module was used,
potentially resulting in arbitrary code execution (CVE-2012-2089).
Thanks to Matthew Daley.
*) Bugfix: nginx/Windows might be terminated abnormally.
Thanks to Vincent Lee.
*) Bugfix: nginx hogged CPU if all servers in an upstream were marked as
"backup".
*) Bugfix: the "allow" and "deny" directives might be inherited
incorrectly if they were used with IPv6 addresses.
*) Bugfix: the "modern_browser" and "ancient_browser" directives might
be inherited incorrectly.
*) Bugfix: timeouts might be handled incorrectly on Solaris/SPARC.
*) Bugfix: in the ngx_http_mp4_module.
Diffstat (limited to 'src/core/ngx_rbtree.c')
| -rw-r--r-- | src/core/ngx_rbtree.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/src/core/ngx_rbtree.c b/src/core/ngx_rbtree.c index 6ae4d5c05..914ca7e88 100644 --- a/src/core/ngx_rbtree.c +++ b/src/core/ngx_rbtree.c @@ -136,8 +136,7 @@ ngx_rbtree_insert_timer_value(ngx_rbtree_node_t *temp, ngx_rbtree_node_t *node, /* node->key < temp->key */ - p = ((ngx_rbtree_key_int_t) node->key - (ngx_rbtree_key_int_t) temp->key - < 0) + p = ((ngx_rbtree_key_int_t) (node->key - temp->key) < 0) ? &temp->left : &temp->right; if (*p == sentinel) { |