Mercurial > hg > nginx
comparison src/core/ngx_resolver.c @ 4683:84d8e60b65f0
Fixed crash in ngx_resolver_cleanup_tree().
If sending a DNS request fails with an error (e.g., when mistakenly trying
to send it to a local IP broadcast), such a request is not deleted if there
are clients waiting on it. However, it was still erroneously removed from
the queue. Later ngx_resolver_cleanup_tree() attempted to remove it from
the queue again that resulted in a NULL pointer dereference.
author | Ruslan Ermilov <ru@nginx.com> |
---|---|
date | Mon, 18 Jun 2012 12:30:45 +0000 |
parents | af9342747669 |
children | f5c2c9d656f9 |
comparison
equal
deleted
inserted
replaced
4682:752e65c6c0d1 | 4683:84d8e60b65f0 |
---|---|
975 | 975 |
976 ngx_queue_remove(q); | 976 ngx_queue_remove(q); |
977 | 977 |
978 if (rn->waiting) { | 978 if (rn->waiting) { |
979 | 979 |
980 if (ngx_resolver_send_query(r, rn) == NGX_OK) { | 980 (void) ngx_resolver_send_query(r, rn); |
981 | 981 |
982 rn->expire = now + r->resend_timeout; | 982 rn->expire = now + r->resend_timeout; |
983 | 983 |
984 ngx_queue_insert_head(queue, &rn->queue); | 984 ngx_queue_insert_head(queue, q); |
985 } | |
986 | 985 |
987 continue; | 986 continue; |
988 } | 987 } |
989 | 988 |
990 ngx_rbtree_delete(tree, &rn->node); | 989 ngx_rbtree_delete(tree, &rn->node); |