Mercurial > hg > nginx
comparison src/event/ngx_event_pipe.c @ 4895:508e61393b6c
Event pipe: fixed handling of buf_to_file data.
Input filter might free a buffer if there is no data in it, and in case
of first buffer (used for cache header and request header, aka p->buf_to_file)
this resulted in cache corruption. Buffer memory was reused to read upstream
response before headers were written to disk.
Fix is to avoid moving pointers in ngx_event_pipe_add_free_buf() to a buffer
start if we were asked to free a buffer used by p->buf_to_file.
This fixes occasional cache file corruption, usually resulted
in "cache file ... has md5 collision" alerts.
Reported by Anatoli Marinov.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Tue, 30 Oct 2012 11:14:24 +0000 |
parents | 778ef9c3fd2d |
children | 355779f81491 |
comparison
equal
deleted
inserted
replaced
4894:0156fd6f48fa | 4895:508e61393b6c |
---|---|
944 cl = ngx_alloc_chain_link(p->pool); | 944 cl = ngx_alloc_chain_link(p->pool); |
945 if (cl == NULL) { | 945 if (cl == NULL) { |
946 return NGX_ERROR; | 946 return NGX_ERROR; |
947 } | 947 } |
948 | 948 |
949 b->pos = b->start; | 949 if (p->buf_to_file && b->start == p->buf_to_file->start) { |
950 b->last = b->start; | 950 b->pos = p->buf_to_file->last; |
951 b->last = p->buf_to_file->last; | |
952 | |
953 } else { | |
954 b->pos = b->start; | |
955 b->last = b->start; | |
956 } | |
957 | |
951 b->shadow = NULL; | 958 b->shadow = NULL; |
952 | 959 |
953 cl->buf = b; | 960 cl->buf = b; |
954 | 961 |
955 if (p->free_raw_bufs == NULL) { | 962 if (p->free_raw_bufs == NULL) { |