diff src/event/quic/ngx_event_quic_frames.c @ 9284:5c6649b4308f

QUIC: ngx_quic_buffer_t use-after-free protection. Previously the last chain field of ngx_quic_buffer_t could still reference freed chains and buffers after calling ngx_quic_free_buffer(). While normally an ngx_quic_buffer_t object should not be used after freeing, resetting last_chain field would prevent a potential use-after-free.
author Roman Arutyunyan <arut@nginx.com>
date Tue, 28 May 2024 17:19:21 +0400
parents 7ec761f0365f
children
line wrap: on
line diff
--- a/src/event/quic/ngx_event_quic_frames.c
+++ b/src/event/quic/ngx_event_quic_frames.c
@@ -648,6 +648,7 @@ ngx_quic_free_buffer(ngx_connection_t *c
     ngx_quic_free_chain(c, qb->chain);
 
     qb->chain = NULL;
+    qb->last_chain = NULL;
 }