Mercurial > hg > nginx
comparison src/event/ngx_event_pipe.c @ 4908:826ca1b53376 stable-1.2
Merge of r4896: event pipe: fixed handling of buf_to_file data.
Input filter might free a buffer if there is no data in it, and in case
of first buffer (used for cache header and request header, aka p->buf_to_file)
this resulted in cache corruption. Buffer memory was reused to read upstream
response before headers were written to disk.
Fix is to avoid moving pointers in ngx_event_pipe_add_free_buf() to a buffer
start if we were asked to free a buffer used by p->buf_to_file.
This fixes occasional cache file corruption, usually resulted
in "cache file ... has md5 collision" alerts.
Reported by Anatoli Marinov.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Tue, 13 Nov 2012 11:24:14 +0000 |
parents | 778ef9c3fd2d |
children | 355779f81491 |
comparison
equal
deleted
inserted
replaced
4907:01d3d3a185e9 | 4908:826ca1b53376 |
---|---|
944 cl = ngx_alloc_chain_link(p->pool); | 944 cl = ngx_alloc_chain_link(p->pool); |
945 if (cl == NULL) { | 945 if (cl == NULL) { |
946 return NGX_ERROR; | 946 return NGX_ERROR; |
947 } | 947 } |
948 | 948 |
949 b->pos = b->start; | 949 if (p->buf_to_file && b->start == p->buf_to_file->start) { |
950 b->last = b->start; | 950 b->pos = p->buf_to_file->last; |
951 b->last = p->buf_to_file->last; | |
952 | |
953 } else { | |
954 b->pos = b->start; | |
955 b->last = b->start; | |
956 } | |
957 | |
951 b->shadow = NULL; | 958 b->shadow = NULL; |
952 | 959 |
953 cl->buf = b; | 960 cl->buf = b; |
954 | 961 |
955 if (p->free_raw_bufs == NULL) { | 962 if (p->free_raw_bufs == NULL) { |