Storing pointer to next buffer in chain before free the buffer.
This is required to avoid dereference of freed memory. Found by Coverity (CID 353372).
This commit is contained in:
@@ -172,11 +172,12 @@ nxt_buf_pool_free(nxt_buf_pool_t *bp, nxt_buf_t *b)
|
||||
void
|
||||
nxt_buf_pool_destroy(nxt_buf_pool_t *bp)
|
||||
{
|
||||
nxt_buf_t *b;
|
||||
nxt_buf_t *b, *n;
|
||||
|
||||
bp->destroy = 1;
|
||||
|
||||
for (b = bp->free; b != NULL; b = b->next) {
|
||||
for (b = bp->free; b != NULL; b = n) {
|
||||
n = b->next;
|
||||
nxt_buf_free(bp->mem_pool, b);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user