Storing pointer to next buffer in chain before free the buffer.

This is required to avoid dereference of freed memory.

Found by Coverity (CID 353372).
This commit is contained in:
Max Romanov
2020-02-03 11:14:14 +03:00
parent 51120e06e3
commit 8c0f2cebf5

View File

@@ -172,11 +172,12 @@ nxt_buf_pool_free(nxt_buf_pool_t *bp, nxt_buf_t *b)
void
nxt_buf_pool_destroy(nxt_buf_pool_t *bp)
{
nxt_buf_t *b;
nxt_buf_t *b, *n;
bp->destroy = 1;
for (b = bp->free; b != NULL; b = b->next) {
for (b = bp->free; b != NULL; b = n) {
n = b->next;
nxt_buf_free(bp->mem_pool, b);
}