technocloud-public/nginx-unit
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Storing pointer to next buffer in chain before free the buffer.

Browse Source 
This is required to avoid dereference of freed memory.

Found by Coverity (CID 353372).
This commit is contained in:
Max Romanov
2020-02-03 11:14:14 +03:00
parent 51120e06e3
commit 8c0f2cebf5
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/nxt_buf_pool.c
View File

@@ -172,11 +172,12 @@ nxt_buf_pool_free(nxt_buf_pool_t *bp, nxt_buf_t *b)
void void
nxt_buf_pool_destroy(nxt_buf_pool_t *bp) nxt_buf_pool_destroy(nxt_buf_pool_t *bp)
{ {
nxt_buf_t *b; nxt_buf_t *b, *n;
bp->destroy = 1; bp->destroy = 1;
for (b = bp->free; b != NULL; b = b->next) { for (b = bp->free; b != NULL; b = n) {
n = b->next;
nxt_buf_free(bp->mem_pool, b); nxt_buf_free(bp->mem_pool, b);
} }