comparison src/http/ngx_http_upstream.c @ 6986:0cdee26605f3

Cleaned up r->headers_out.headers allocation error handling. If initialization of a header failed for some reason after ngx_list_push(), leaving the header as is can result in uninitialized memory access by the header filter or the log module. The fix is to clear partially initialized headers in case of errors. For the Cache-Control header, the fix is to postpone pushing r->headers_out.cache_control until its value is completed.
author Sergey Kandaurov <pluknet@nginx.com>
date Thu, 20 Apr 2017 18:26:37 +0300
parents fa56ab75cffc
children 9552758a786e
comparison
equal deleted inserted replaced
6985:23ecffd5bcfe 6986:0cdee26605f3
4895 { 4895 {
4896 return NGX_ERROR; 4896 return NGX_ERROR;
4897 } 4897 }
4898 } 4898 }
4899 4899
4900 ho = ngx_list_push(&r->headers_out.headers);
4901 if (ho == NULL) {
4902 return NGX_ERROR;
4903 }
4904
4905 *ho = *h;
4906
4900 ph = ngx_array_push(pa); 4907 ph = ngx_array_push(pa);
4901 if (ph == NULL) { 4908 if (ph == NULL) {
4902 return NGX_ERROR; 4909 return NGX_ERROR;
4903 } 4910 }
4904 4911
4905 ho = ngx_list_push(&r->headers_out.headers);
4906 if (ho == NULL) {
4907 return NGX_ERROR;
4908 }
4909
4910 *ho = *h;
4911 *ph = ho; 4912 *ph = ho;
4912 4913
4913 return NGX_OK; 4914 return NGX_OK;
4914 } 4915 }
4915 4916