technocloud-public/nginx-unit
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fixed segmentation fault during reconfiguration.

Browse Source 
If idle connection was closed before h1proto had been allocated
then c->socket.data is NULL.  This happens if nxt_h1p_idle_response()
is called by nxt_h1p_idle_close().  However, h1p->conn_write_tail
is used only in nxt_h1p_request_send() that would not be called
after nxt_h1p_idle_response().

The bug was introduced in f237e8c553fd.
This commit is contained in:
Igor Sysoev
2020-09-18 13:20:06 +03:00
parent 6cfbf4ba79
commit 6b9882fc14
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/nxt_h1proto.c
View File

@@ -1876,7 +1876,6 @@ nxt_h1p_idle_response(nxt_task_t *task, nxt_conn_t *c)
u_char *p; u_char *p;
size_t size; size_t size;
nxt_buf_t *out, *last; nxt_buf_t *out, *last;
nxt_h1proto_t *h1p;
size = nxt_length(NXT_H1P_IDLE_TIMEOUT) size = nxt_length(NXT_H1P_IDLE_TIMEOUT)
+ nxt_http_date_cache.size + nxt_http_date_cache.size
@@ -1906,9 +1905,6 @@ nxt_h1p_idle_response(nxt_task_t *task, nxt_conn_t *c)
last->completion_handler = nxt_h1p_idle_response_sent; last->completion_handler = nxt_h1p_idle_response_sent;
last->parent = c; last->parent = c;
h1p = c->socket.data;
h1p->conn_write_tail = &last->next;
c->write = out; c->write = out;
c->write_state = &nxt_h1p_timeout_response_state; c->write_state = &nxt_h1p_timeout_response_state;