Mercurial > hg > nginx
changeset 4683:84d8e60b65f0
Fixed crash in ngx_resolver_cleanup_tree().
If sending a DNS request fails with an error (e.g., when mistakenly trying
to send it to a local IP broadcast), such a request is not deleted if there
are clients waiting on it. However, it was still erroneously removed from
the queue. Later ngx_resolver_cleanup_tree() attempted to remove it from
the queue again that resulted in a NULL pointer dereference.
author | Ruslan Ermilov <ru@nginx.com> |
---|---|
date | Mon, 18 Jun 2012 12:30:45 +0000 |
parents | 752e65c6c0d1 |
children | f5c2c9d656f9 |
files | src/core/ngx_resolver.c |
diffstat | 1 files changed, 5 insertions(+), 6 deletions(-) [+] |
line wrap: on
line diff
--- a/src/core/ngx_resolver.c +++ b/src/core/ngx_resolver.c @@ -977,12 +977,11 @@ ngx_resolver_resend(ngx_resolver_t *r, n if (rn->waiting) { - if (ngx_resolver_send_query(r, rn) == NGX_OK) { - - rn->expire = now + r->resend_timeout; - - ngx_queue_insert_head(queue, &rn->queue); - } + (void) ngx_resolver_send_query(r, rn); + + rn->expire = now + r->resend_timeout; + + ngx_queue_insert_head(queue, q); continue; }