Router: fixed crash in OOSM processing.

Multithreaded application may create different shared memory segments in
different threads.  The segments then passed to different router threads.
Because of this multithreading, the order of adding incoming segments is
not determined and there can be situation when some of the incoming segments
are not initialized yet.

This patch simply adds check for NULL to skip non-initialized segments.

Crash reproduced during load tests with high number of simultaneous
connections (1024 and more).

docs/changes.xml

@@ -35,6 +35,12 @@ bug had appeared in 1.21.0.
 </para>
 </change>
 
+<change type="bugfix">
+<para>
+the router process could crash with multithreaded applications under high load.
+</para>
+</change>
+
 </changes>
 
 

src/nxt_router.c

@@ -5373,7 +5373,7 @@ nxt_router_oosm_handler(nxt_task_t *task, nxt_port_recv_msg_t *msg)
     nxt_bool_t               ack;
     nxt_process_t            *process;
     nxt_free_map_t           *m;
-    nxt_port_mmap_header_t   *hdr;
+    nxt_port_mmap_handler_t  *mmap_handler;
 
     nxt_debug(task, "oosm in %PI", msg->port_msg.pid);
 
@@ -5394,8 +5394,13 @@ nxt_router_oosm_handler(nxt_task_t *task, nxt_port_recv_msg_t *msg)
     nxt_thread_mutex_lock(&process->incoming.mutex);
 
     for (i = 0; i < process->incoming.size; i++) {
-        hdr = process->incoming.elts[i].mmap_handler->hdr;
-        m = hdr->free_map;
+        mmap_handler = process->incoming.elts[i].mmap_handler;
+
+        if (nxt_slow_path(mmap_handler == NULL)) {
+            continue;
+        }
+
+        m = mmap_handler->hdr->free_map;
 
         for (mi = 0; mi < MAX_FREE_IDX; mi++) {
             if (m[mi] != 0) {