Mercurial > hg > nginx-quic
comparison src/event/ngx_event_udp.c @ 7391:27559d4a5151
Stream: fixed possible use of a freed connection.
The session handler may result in session termination, thus a connection
pool (from which c->udp was allocated) may be destroyed.
author | Vladimir Homutov <vl@nginx.com> |
---|---|
date | Wed, 07 Nov 2018 13:22:14 +0300 |
parents | d27aa9060c95 |
children | 4698cede59ff |
comparison
equal
deleted
inserted
replaced
7390:2e7c4c3b0644 | 7391:27559d4a5151 |
---|---|
259 c->udp->buffer = &buf; | 259 c->udp->buffer = &buf; |
260 rev->ready = 1; | 260 rev->ready = 1; |
261 | 261 |
262 rev->handler(rev); | 262 rev->handler(rev); |
263 | 263 |
264 c->udp->buffer = NULL; | 264 if (c->udp) { |
265 c->udp->buffer = NULL; | |
266 } | |
267 | |
265 rev->ready = 0; | 268 rev->ready = 0; |
266 | 269 |
267 goto next; | 270 goto next; |
268 } | 271 } |
269 | 272 |
559 ngx_delete_udp_connection(void *data) | 562 ngx_delete_udp_connection(void *data) |
560 { | 563 { |
561 ngx_connection_t *c = data; | 564 ngx_connection_t *c = data; |
562 | 565 |
563 ngx_rbtree_delete(&c->listening->rbtree, &c->udp->node); | 566 ngx_rbtree_delete(&c->listening->rbtree, &c->udp->node); |
567 | |
568 c->udp = NULL; | |
564 } | 569 } |
565 | 570 |
566 | 571 |
567 static ngx_connection_t * | 572 static ngx_connection_t * |
568 ngx_lookup_udp_connection(ngx_listening_t *ls, struct sockaddr *sockaddr, | 573 ngx_lookup_udp_connection(ngx_listening_t *ls, struct sockaddr *sockaddr, |