Mercurial > hg > nginx

comparison src/http/modules/ngx_http_geo_module.c @ 6655:873d7053efb9

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Geo: fixed access to already freed memory. Previously, in "ranges" mode when all added ranges were deleted, the ctx.high.low[i] was left pointing to a temporary array.
author Valentin Bartenev <vbart@nginx.com>
date Thu, 18 Aug 2016 17:11:03 +0300
parents c5ec6944de98
children ec141a44641b
comparison
equal deleted inserted replaced
6654:c131f20c9562 6655:873d7053efb9
467 467
468 if (ctx.high.low && !ctx.binary_include) { 468 if (ctx.high.low && !ctx.binary_include) {
469 for (i = 0; i < 0x10000; i++) { 469 for (i = 0; i < 0x10000; i++) {
470 a = (ngx_array_t *) ctx.high.low[i]; 470 a = (ngx_array_t *) ctx.high.low[i];
471 471
472 if (a == NULL || a->nelts == 0) { 472 if (a == NULL) {
473 continue;
474 }
475
476 if (a->nelts == 0) {
477 ctx.high.low[i] = NULL;
473 continue; 478 continue;
474 } 479 }
475 480
476 len = a->nelts * sizeof(ngx_http_geo_range_t); 481 len = a->nelts * sizeof(ngx_http_geo_range_t);
477 482