Mercurial > hg > nginx

changeset 9141:5d1e7c74aadf

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
QUIC: avoid accessing freed frame. Previously the field pnum of a potentially freed frame was accessed. Now the value is copied to a local variable. The old behavior did not cause any problems since the frame memory is not freed, but is moved to a free queue instead.
author Roman Arutyunyan <arut@nginx.com>
date Tue, 01 Aug 2023 11:20:04 +0400
parents e9a003d40485
children 7e8ee4b7cbf4
files src/event/quic/ngx_event_quic_ack.c
diffstat 1 files changed, 3 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/src/event/quic/ngx_event_quic_ack.c
+++ b/src/event/quic/ngx_event_quic_ack.c
@@ -548,6 +548,7 @@ ngx_quic_persistent_congestion(ngx_conne
 void
 ngx_quic_resend_frames(ngx_connection_t *c, ngx_quic_send_ctx_t *ctx)
 {
+    uint64_t                pnum;
     ngx_queue_t            *q;
     ngx_quic_frame_t       *f, *start;
     ngx_quic_stream_t      *qs;
@@ -556,6 +557,7 @@ ngx_quic_resend_frames(ngx_connection_t 
     qc = ngx_quic_get_connection(c);
     q = ngx_queue_head(&ctx->sent);
     start = ngx_queue_data(q, ngx_quic_frame_t, queue);
+    pnum = start->pnum;
 
     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
                    "quic resend packet pnum:%uL", start->pnum);
@@ -565,7 +567,7 @@ ngx_quic_resend_frames(ngx_connection_t 
     do {
         f = ngx_queue_data(q, ngx_quic_frame_t, queue);
 
-        if (f->pnum != start->pnum) {
+        if (f->pnum != pnum) {
             break;
         }