Mercurial > hg > nginx-quic
view auto/modules @ 6359:dac6eda40475 stable-1.8
Resolver: fixed use-after-free memory accesses with CNAME.
When several requests were waiting for a response, then after getting
a CNAME response only the last request's context had the name updated.
Contexts of other requests had the wrong name. This name was used by
ngx_resolve_name_done() to find the node to remove the request context
from. When the name was wrong, the request could not be properly
cancelled, its context was freed but stayed linked to the node's waiting
list. This happened e.g. when the first request was aborted or timed
out before the resolving completed. When it completed, this triggered
a use-after-free memory access by calling ctx->handler of already freed
request context. The bug manifests itself by
"could not cancel <name> resolving" alerts in error_log.
When a request was responded with a CNAME, the request context kept
the pointer to the original node's rn->u.cname. If the original node
expired before the resolving timed out or completed with an error,
this would trigger a use-after-free memory access via ctx->name in
ctx->handler().
The fix is to keep ctx->name unmodified. The name from context
is no longer used by ngx_resolve_name_done(). Instead, we now keep
the pointer to resolver node to which this request is linked.
Keeping the original name intact also improves logging.
author | Roman Arutyunyan <arut@nginx.com> |
---|---|
date | Tue, 26 Jan 2016 16:46:59 +0300 |
parents | 466bd63b63d1 |
children | 79ddb0bdb273 |
line wrap: on
line source
# Copyright (C) Igor Sysoev # Copyright (C) Nginx, Inc. if [ $EVENT_SELECT = NO -a $EVENT_FOUND = NO ]; then EVENT_SELECT=YES fi if [ $EVENT_SELECT = YES ]; then have=NGX_HAVE_SELECT . auto/have CORE_SRCS="$CORE_SRCS $SELECT_SRCS" EVENT_MODULES="$EVENT_MODULES $SELECT_MODULE" fi if [ $EVENT_POLL = NO -a $EVENT_FOUND = NO ]; then EVENT_POLL=YES fi if [ $EVENT_POLL = YES ]; then have=NGX_HAVE_POLL . auto/have CORE_SRCS="$CORE_SRCS $POLL_SRCS" EVENT_MODULES="$EVENT_MODULES $POLL_MODULE" fi if [ $NGX_TEST_BUILD_DEVPOLL = YES ]; then have=NGX_HAVE_DEVPOLL . auto/have have=NGX_TEST_BUILD_DEVPOLL . auto/have EVENT_MODULES="$EVENT_MODULES $DEVPOLL_MODULE" CORE_SRCS="$CORE_SRCS $DEVPOLL_SRCS" fi if [ $NGX_TEST_BUILD_EVENTPORT = YES ]; then have=NGX_HAVE_EVENTPORT . auto/have have=NGX_TEST_BUILD_EVENTPORT . auto/have EVENT_MODULES="$EVENT_MODULES $EVENTPORT_MODULE" CORE_SRCS="$CORE_SRCS $EVENTPORT_SRCS" fi if [ $NGX_TEST_BUILD_EPOLL = YES ]; then have=NGX_HAVE_EPOLL . auto/have have=NGX_HAVE_EPOLLRDHUP . auto/have have=NGX_HAVE_EVENTFD . auto/have have=NGX_TEST_BUILD_EPOLL . auto/have EVENT_MODULES="$EVENT_MODULES $EPOLL_MODULE" CORE_SRCS="$CORE_SRCS $EPOLL_SRCS" fi if [ $NGX_TEST_BUILD_RTSIG = YES ]; then have=NGX_HAVE_RTSIG . auto/have have=NGX_TEST_BUILD_RTSIG . auto/have EVENT_MODULES="$EVENT_MODULES $RTSIG_MODULE" CORE_SRCS="$CORE_SRCS $RTSIG_SRCS" fi if [ $NGX_TEST_BUILD_SOLARIS_SENDFILEV = YES ]; then have=NGX_TEST_BUILD_SOLARIS_SENDFILEV . auto/have CORE_SRCS="$CORE_SRCS $SOLARIS_SENDFILEV_SRCS" fi if [ $HTTP != YES ]; then have=NGX_CRYPT . auto/nohave CRYPT_LIB= fi if [ $HTTP_CACHE = YES ]; then USE_MD5=YES have=NGX_HTTP_CACHE . auto/have HTTP_SRCS="$HTTP_SRCS $HTTP_FILE_CACHE_SRCS" fi if [ $HTTP_SSI = YES ]; then HTTP_POSTPONE=YES fi if [ $HTTP_ADDITION = YES ]; then HTTP_POSTPONE=YES fi # the module order is important # ngx_http_static_module # ngx_http_gzip_static_module # ngx_http_dav_module # ngx_http_autoindex_module # ngx_http_index_module # ngx_http_random_index_module # # ngx_http_access_module # ngx_http_realip_module # # # the filter order is important # ngx_http_write_filter # ngx_http_header_filter # ngx_http_chunked_filter # ngx_http_spdy_filter # ngx_http_range_header_filter # ngx_http_gzip_filter # ngx_http_postpone_filter # ngx_http_ssi_filter # ngx_http_charset_filter # ngx_http_xslt_filter # ngx_http_image_filter # ngx_http_sub_filter # ngx_http_addition_filter # ngx_http_gunzip_filter # ngx_http_userid_filter # ngx_http_headers_filter # ngx_http_copy_filter # ngx_http_range_body_filter # ngx_http_not_modified_filter HTTP_FILTER_MODULES="$HTTP_WRITE_FILTER_MODULE \ $HTTP_HEADER_FILTER_MODULE \ $HTTP_CHUNKED_FILTER_MODULE" if [ $HTTP_SPDY = YES ]; then HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_SPDY_FILTER_MODULE" fi HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_RANGE_HEADER_FILTER_MODULE" if [ $HTTP_GZIP = YES ]; then have=NGX_HTTP_GZIP . auto/have USE_ZLIB=YES HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_GZIP_FILTER_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_GZIP_SRCS" fi if [ $HTTP_POSTPONE = YES ]; then HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_POSTPONE_FILTER_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_POSTPONE_FILTER_SRCS" fi if [ $HTTP_SSI = YES ]; then have=NGX_HTTP_SSI . auto/have HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_SSI_FILTER_MODULE" HTTP_DEPS="$HTTP_DEPS $HTTP_SSI_DEPS" HTTP_SRCS="$HTTP_SRCS $HTTP_SSI_SRCS" fi if [ $HTTP_CHARSET = YES ]; then HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_CHARSET_FILTER_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_CHARSET_SRCS" fi if [ $HTTP_XSLT = YES ]; then USE_LIBXSLT=YES HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_XSLT_FILTER_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_XSLT_SRCS" fi if [ $HTTP_IMAGE_FILTER = YES ]; then USE_LIBGD=YES HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_IMAGE_FILTER_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_IMAGE_SRCS" fi if [ $HTTP_SUB = YES ]; then HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_SUB_FILTER_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_SUB_SRCS" fi if [ $HTTP_ADDITION = YES ]; then HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_ADDITION_FILTER_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_ADDITION_SRCS" fi if [ $HTTP_GUNZIP = YES ]; then have=NGX_HTTP_GZIP . auto/have USE_ZLIB=YES HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_GUNZIP_FILTER_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_GUNZIP_SRCS" fi if [ $HTTP_USERID = YES ]; then HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_USERID_FILTER_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_USERID_SRCS" fi if [ $HTTP_SPDY = YES ]; then have=NGX_HTTP_SPDY . auto/have USE_ZLIB=YES HTTP_MODULES="$HTTP_MODULES $HTTP_SPDY_MODULE" HTTP_DEPS="$HTTP_DEPS $HTTP_SPDY_DEPS" HTTP_SRCS="$HTTP_SRCS $HTTP_SPDY_SRCS" fi HTTP_MODULES="$HTTP_MODULES $HTTP_STATIC_MODULE" if [ $HTTP_GZIP_STATIC = YES ]; then have=NGX_HTTP_GZIP . auto/have HTTP_MODULES="$HTTP_MODULES $HTTP_GZIP_STATIC_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_GZIP_STATIC_SRCS" fi if [ $HTTP_DAV = YES ]; then have=NGX_HTTP_DAV . auto/have HTTP_MODULES="$HTTP_MODULES $HTTP_DAV_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_DAV_SRCS" fi if [ $HTTP_AUTOINDEX = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_AUTOINDEX_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_AUTOINDEX_SRCS" fi HTTP_MODULES="$HTTP_MODULES $HTTP_INDEX_MODULE" if [ $HTTP_RANDOM_INDEX = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_RANDOM_INDEX_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_RANDOM_INDEX_SRCS" fi if [ $HTTP_AUTH_REQUEST = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_AUTH_REQUEST_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_AUTH_REQUEST_SRCS" fi if [ $HTTP_AUTH_BASIC = YES ]; then USE_MD5=YES USE_SHA1=YES have=NGX_CRYPT . auto/have HTTP_MODULES="$HTTP_MODULES $HTTP_AUTH_BASIC_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_AUTH_BASIC_SRCS" CORE_LIBS="$CORE_LIBS $CRYPT_LIB" fi if [ $HTTP_ACCESS = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_ACCESS_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_ACCESS_SRCS" fi if [ $HTTP_LIMIT_CONN = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_LIMIT_CONN_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_LIMIT_CONN_SRCS" fi if [ $HTTP_LIMIT_REQ = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_LIMIT_REQ_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_LIMIT_REQ_SRCS" fi if [ $HTTP_REALIP = YES ]; then have=NGX_HTTP_REALIP . auto/have have=NGX_HTTP_X_FORWARDED_FOR . auto/have HTTP_MODULES="$HTTP_MODULES $HTTP_REALIP_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_REALIP_SRCS" fi if [ $HTTP_STATUS = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_STATUS_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_STATUS_SRCS" fi if [ $HTTP_GEO = YES ]; then have=NGX_HTTP_X_FORWARDED_FOR . auto/have HTTP_MODULES="$HTTP_MODULES $HTTP_GEO_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_GEO_SRCS" fi if [ $HTTP_GEOIP = YES ]; then have=NGX_HTTP_X_FORWARDED_FOR . auto/have HTTP_MODULES="$HTTP_MODULES $HTTP_GEOIP_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_GEOIP_SRCS" fi if [ $HTTP_MAP = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_MAP_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_MAP_SRCS" fi if [ $HTTP_SPLIT_CLIENTS = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_SPLIT_CLIENTS_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_SPLIT_CLIENTS_SRCS" fi if [ $HTTP_REFERER = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_REFERER_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_REFERER_SRCS" fi if [ $HTTP_REWRITE = YES -a $USE_PCRE != DISABLED ]; then USE_PCRE=YES HTTP_MODULES="$HTTP_MODULES $HTTP_REWRITE_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_REWRITE_SRCS" fi if [ $HTTP_SSL = YES ]; then USE_OPENSSL=YES have=NGX_HTTP_SSL . auto/have HTTP_MODULES="$HTTP_MODULES $HTTP_SSL_MODULE" HTTP_DEPS="$HTTP_DEPS $HTTP_SSL_DEPS" HTTP_SRCS="$HTTP_SRCS $HTTP_SSL_SRCS" fi if [ $HTTP_PROXY = YES ]; then have=NGX_HTTP_X_FORWARDED_FOR . auto/have #USE_MD5=YES HTTP_MODULES="$HTTP_MODULES $HTTP_PROXY_MODULE" HTTP_DEPS="$HTTP_DEPS $HTTP_PROXY_DEPS" HTTP_SRCS="$HTTP_SRCS $HTTP_PROXY_SRCS" fi if [ $HTTP_FASTCGI = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_FASTCGI_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_FASTCGI_SRCS" fi if [ $HTTP_UWSGI = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_UWSGI_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_UWSGI_SRCS" fi if [ $HTTP_SCGI = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_SCGI_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_SCGI_SRCS" fi if [ $HTTP_PERL = YES ]; then USE_PERL=YES HTTP_MODULES="$HTTP_MODULES $HTTP_PERL_MODULE" HTTP_INCS="$HTTP_INCS $HTTP_PERL_INCS" HTTP_DEPS="$HTTP_DEPS $HTTP_PERL_DEPS" HTTP_SRCS="$HTTP_SRCS $HTTP_PERL_SRCS" fi if [ $HTTP_MEMCACHED = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_MEMCACHED_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_MEMCACHED_SRCS" fi if [ $HTTP_EMPTY_GIF = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_EMPTY_GIF_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_EMPTY_GIF_SRCS" fi if [ $HTTP_BROWSER = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_BROWSER_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_BROWSER_SRCS" fi if [ $HTTP_SECURE_LINK = YES ]; then USE_MD5=YES HTTP_MODULES="$HTTP_MODULES $HTTP_SECURE_LINK_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_SECURE_LINK_SRCS" fi if [ $HTTP_DEGRADATION = YES ]; then have=NGX_HTTP_DEGRADATION . auto/have HTTP_MODULES="$HTTP_MODULES $HTTP_DEGRADATION_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_DEGRADATION_SRCS" fi if [ $HTTP_FLV = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_FLV_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_FLV_SRCS" fi if [ $HTTP_MP4 = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_MP4_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_MP4_SRCS" fi if [ $HTTP_UPSTREAM_HASH = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_UPSTREAM_HASH_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_UPSTREAM_HASH_SRCS" fi if [ $HTTP_UPSTREAM_IP_HASH = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_UPSTREAM_IP_HASH_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_UPSTREAM_IP_HASH_SRCS" fi if [ $HTTP_UPSTREAM_LEAST_CONN = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_UPSTREAM_LEAST_CONN_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_UPSTREAM_LEAST_CONN_SRCS" fi if [ $HTTP_UPSTREAM_KEEPALIVE = YES ]; then HTTP_MODULES="$HTTP_MODULES $HTTP_UPSTREAM_KEEPALIVE_MODULE" HTTP_SRCS="$HTTP_SRCS $HTTP_UPSTREAM_KEEPALIVE_SRCS" fi if [ $HTTP_STUB_STATUS = YES ]; then have=NGX_STAT_STUB . auto/have HTTP_MODULES="$HTTP_MODULES ngx_http_stub_status_module" HTTP_SRCS="$HTTP_SRCS src/http/modules/ngx_http_stub_status_module.c" fi #if [ -r $NGX_OBJS/auto ]; then # . $NGX_OBJS/auto #fi if test -n "$NGX_ADDONS"; then echo configuring additional modules for ngx_addon_dir in $NGX_ADDONS do echo "adding module in $ngx_addon_dir" if test -f $ngx_addon_dir/config; then . $ngx_addon_dir/config echo " + $ngx_addon_name was configured" else echo "$0: error: no $ngx_addon_dir/config was found" exit 1 fi done fi if [ $MAIL_SSL = YES ]; then have=NGX_MAIL_SSL . auto/have USE_OPENSSL=YES fi modules="$CORE_MODULES $EVENT_MODULES" # thread pool module should be initialized after events if [ $USE_THREADS = YES ]; then modules="$modules $THREAD_POOL_MODULE" fi if [ $USE_OPENSSL = YES ]; then modules="$modules $OPENSSL_MODULE" CORE_DEPS="$CORE_DEPS $OPENSSL_DEPS" CORE_SRCS="$CORE_SRCS $OPENSSL_SRCS" fi if [ $USE_PCRE = YES ]; then modules="$modules $REGEX_MODULE" CORE_DEPS="$CORE_DEPS $REGEX_DEPS" CORE_SRCS="$CORE_SRCS $REGEX_SRCS" fi if [ $HTTP = YES ]; then modules="$modules $HTTP_MODULES $HTTP_FILTER_MODULES \ $HTTP_HEADERS_FILTER_MODULE \ $HTTP_AUX_FILTER_MODULES \ $HTTP_COPY_FILTER_MODULE \ $HTTP_RANGE_BODY_FILTER_MODULE \ $HTTP_NOT_MODIFIED_FILTER_MODULE" NGX_ADDON_DEPS="$NGX_ADDON_DEPS \$(HTTP_DEPS)" fi if [ $MAIL = YES ]; then modules="$modules $MAIL_MODULES" if [ $MAIL_SSL = YES ]; then modules="$modules $MAIL_SSL_MODULE" MAIL_DEPS="$MAIL_DEPS $MAIL_SSL_DEPS" MAIL_SRCS="$MAIL_SRCS $MAIL_SSL_SRCS" fi if [ $MAIL_POP3 = YES ]; then modules="$modules $MAIL_POP3_MODULE" MAIL_DEPS="$MAIL_DEPS $MAIL_POP3_DEPS" MAIL_SRCS="$MAIL_SRCS $MAIL_POP3_SRCS" fi if [ $MAIL_IMAP = YES ]; then modules="$modules $MAIL_IMAP_MODULE" MAIL_DEPS="$MAIL_DEPS $MAIL_IMAP_DEPS" MAIL_SRCS="$MAIL_SRCS $MAIL_IMAP_SRCS" fi if [ $MAIL_SMTP = YES ]; then modules="$modules $MAIL_SMTP_MODULE" MAIL_DEPS="$MAIL_DEPS $MAIL_SMTP_DEPS" MAIL_SRCS="$MAIL_SRCS $MAIL_SMTP_SRCS" fi modules="$modules $MAIL_AUTH_HTTP_MODULE" MAIL_SRCS="$MAIL_SRCS $MAIL_AUTH_HTTP_SRCS" modules="$modules $MAIL_PROXY_MODULE" MAIL_SRCS="$MAIL_SRCS $MAIL_PROXY_SRCS" NGX_ADDON_DEPS="$NGX_ADDON_DEPS \$(MAIL_DEPS)" fi if [ $NGX_GOOGLE_PERFTOOLS = YES ]; then modules="$modules $NGX_GOOGLE_PERFTOOLS_MODULE" NGX_MISC_SRCS="$NGX_MISC_SRCS $NGX_GOOGLE_PERFTOOLS_SRCS" fi if [ $NGX_CPP_TEST = YES ]; then NGX_MISC_SRCS="$NGX_MISC_SRCS $NGX_CPP_TEST_SRCS" CORE_LIBS="$CORE_LIBS -lstdc++" fi cat << END > $NGX_MODULES_C #include <ngx_config.h> #include <ngx_core.h> $NGX_PRAGMA END for mod in $modules do echo "extern ngx_module_t $mod;" >> $NGX_MODULES_C done echo >> $NGX_MODULES_C echo 'ngx_module_t *ngx_modules[] = {' >> $NGX_MODULES_C for mod in $modules do echo " &$mod," >> $NGX_MODULES_C done cat << END >> $NGX_MODULES_C NULL }; END