Mercurial > hg > nginx
comparison src/event/quic/ngx_event_quic_frames.c @ 9284:5c6649b4308f
QUIC: ngx_quic_buffer_t use-after-free protection.
Previously the last chain field of ngx_quic_buffer_t could still reference freed
chains and buffers after calling ngx_quic_free_buffer(). While normally an
ngx_quic_buffer_t object should not be used after freeing, resetting last_chain
field would prevent a potential use-after-free.
| author | Roman Arutyunyan <arut@nginx.com> |
|---|---|
| date | Tue, 28 May 2024 17:19:21 +0400 |
| parents | 7ec761f0365f |
| children |
comparison
equal
deleted
inserted
replaced
| 9283:bbdcab20d67e | 9284:5c6649b4308f |
|---|---|
| 646 ngx_quic_free_buffer(ngx_connection_t *c, ngx_quic_buffer_t *qb) | 646 ngx_quic_free_buffer(ngx_connection_t *c, ngx_quic_buffer_t *qb) |
| 647 { | 647 { |
| 648 ngx_quic_free_chain(c, qb->chain); | 648 ngx_quic_free_chain(c, qb->chain); |
| 649 | 649 |
| 650 qb->chain = NULL; | 650 qb->chain = NULL; |
| 651 qb->last_chain = NULL; | |
| 651 } | 652 } |
| 652 | 653 |
| 653 | 654 |
| 654 #if (NGX_DEBUG) | 655 #if (NGX_DEBUG) |
| 655 | 656 |