Mercurial > hg > nginx
comparison src/event/ngx_event_pipe.c @ 4895:508e61393b6c
Event pipe: fixed handling of buf_to_file data.
Input filter might free a buffer if there is no data in it, and in case
of first buffer (used for cache header and request header, aka p->buf_to_file)
this resulted in cache corruption. Buffer memory was reused to read upstream
response before headers were written to disk.
Fix is to avoid moving pointers in ngx_event_pipe_add_free_buf() to a buffer
start if we were asked to free a buffer used by p->buf_to_file.
This fixes occasional cache file corruption, usually resulted
in "cache file ... has md5 collision" alerts.
Reported by Anatoli Marinov.
| author | Maxim Dounin <mdounin@mdounin.ru> |
|---|---|
| date | Tue, 30 Oct 2012 11:14:24 +0000 |
| parents | 778ef9c3fd2d |
| children | 355779f81491 |
comparison
equal
deleted
inserted
replaced
| 4894:0156fd6f48fa | 4895:508e61393b6c |
|---|---|
| 944 cl = ngx_alloc_chain_link(p->pool); | 944 cl = ngx_alloc_chain_link(p->pool); |
| 945 if (cl == NULL) { | 945 if (cl == NULL) { |
| 946 return NGX_ERROR; | 946 return NGX_ERROR; |
| 947 } | 947 } |
| 948 | 948 |
| 949 b->pos = b->start; | 949 if (p->buf_to_file && b->start == p->buf_to_file->start) { |
| 950 b->last = b->start; | 950 b->pos = p->buf_to_file->last; |
| 951 b->last = p->buf_to_file->last; | |
| 952 | |
| 953 } else { | |
| 954 b->pos = b->start; | |
| 955 b->last = b->start; | |
| 956 } | |
| 957 | |
| 951 b->shadow = NULL; | 958 b->shadow = NULL; |
| 952 | 959 |
| 953 cl->buf = b; | 960 cl->buf = b; |
| 954 | 961 |
| 955 if (p->free_raw_bufs == NULL) { | 962 if (p->free_raw_bufs == NULL) { |