Mercurial > hg > nginx
view src/os/unix/ngx_sunpro_sparc64.il @ 7048:80224192163c
Resolver: fixed possible use-after-free while resolving SRV.
Resolving an SRV record includes resolving its host names in subrequests.
Previously, if memory allocation failed while reporting a subrequest result
after receiving a response from a DNS server, the SRV resolve handler was
called immediately with the NGX_ERROR state. However, if the SRV record
included another copy of the resolved name, it was reported once again.
This could trigger the use-after-free memory access after SRV resolve
handler freed the resolve context by calling ngx_resolve_name_done().
Now the SRV resolve handler is called only when all its subrequests are
completed.
author | Roman Arutyunyan <arut@nginx.com> |
---|---|
date | Tue, 04 Jul 2017 18:07:29 +0300 |
parents | d620f497c50f |
children |
line wrap: on
line source
/ / Copyright (C) Igor Sysoev / Copyright (C) Nginx, Inc. / / "casa [%o2] 0x80, %o1, %o0" and / "casxa [%o2] 0x80, %o1, %o0" do the following: / / if ([%o2] == %o1) { / swap(%o0, [%o2]); / } else { / %o0 = [%o2]; / } / ngx_atomic_uint_t ngx_casa(ngx_atomic_uint_t set, ngx_atomic_uint_t old, / ngx_atomic_t *lock); / / the arguments are passed in the %o0, %o1, %o2 / the result is returned in the %o0 .inline ngx_casa,0 casa [%o2] 0x80, %o1, %o0 .end / ngx_atomic_uint_t ngx_casxa(ngx_atomic_uint_t set, ngx_atomic_uint_t old, / ngx_atomic_t *lock); / / the arguments are passed in the %o0, %o1, %o2 / the result is returned in the %o0 .inline ngx_casxa,0 casxa [%o2] 0x80, %o1, %o0 .end