Kaynağa Gözat

fixed crash in read_event_handler if using id after the request died

tags/v0.4
Brice Figureau 18 yıl önce
ebeveyn
işleme
2feeda413b
1 değiştirilmiş dosya ile 27 ekleme ve 0 silme
  1. 27
    0
      ngx_http_uploadprogress_module.c

+ 27
- 0
ngx_http_uploadprogress_module.c Dosyayı Görüntüle

285
     return rc;
285
     return rc;
286
 }
286
 }
287
 
287
 
288
+static ngx_str_t* ngx_http_uploadprogress_strdup(ngx_str_t *src,  ngx_log_t * log)
289
+{
290
+    ngx_str_t *dst;
291
+    dst = ngx_alloc(src->len + sizeof(ngx_str_t), log);
292
+    if (dst == NULL) {
293
+        return NULL;
294
+    }
295
+
296
+    dst->len = src->len;
297
+    ngx_memcpy(((char*)dst + sizeof(ngx_str_t)) , src->data, src->len);
298
+    dst->data = ((u_char*)dst + sizeof(ngx_str_t));
299
+    return dst;
300
+}
301
+
302
+static void ngx_http_uploadprogress_strdupfree(ngx_str_t *str)
303
+{
304
+    ngx_free(str);
305
+}
306
+
288
 static void ngx_http_uploadprogress_event_handler(ngx_http_request_t *r)
307
 static void ngx_http_uploadprogress_event_handler(ngx_http_request_t *r)
289
 {
308
 {
290
     ngx_str_t                                   *id;
309
     ngx_str_t                                   *id;
301
 
320
 
302
     /* find node, update rest */
321
     /* find node, update rest */
303
     id = get_tracking_id(r);
322
     id = get_tracking_id(r);
323
+    
324
+    /* perform a deep copy of id */
325
+    id = ngx_http_uploadprogress_strdup(id, r->connection->log);
326
+    
304
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
327
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
305
                    "upload-progress: read_event_handler found id: %V", id);
328
                    "upload-progress: read_event_handler found id: %V", id);
306
     upcf = ngx_http_get_module_loc_conf(r, ngx_http_uploadprogress_module);
329
     upcf = ngx_http_get_module_loc_conf(r, ngx_http_uploadprogress_module);
311
 
334
 
312
     /* at this stage, r is not anymore safe to use */
335
     /* at this stage, r is not anymore safe to use */
313
     /* the request could have been closed/freed behind our back */
336
     /* the request could have been closed/freed behind our back */
337
+    /* and thats the same issue with any other material that was allocated in the request pool */
338
+    /* like id for instance... */
314
 
339
 
315
     if (id == NULL) {
340
     if (id == NULL) {
316
         ngx_log_debug0(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,
341
         ngx_log_debug0(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,
319
     }
344
     }
320
 
345
 
321
     if (upcf->shm_zone == NULL) {
346
     if (upcf->shm_zone == NULL) {
347
+        ngx_http_uploadprogress_strdupfree(id);
322
         ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,
348
         ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,
323
                        "upload-progress: read_event_handler no shm_zone for id: %V", id);
349
                        "upload-progress: read_event_handler no shm_zone for id: %V", id);
324
         return;
350
         return;
344
                        "upload-progress: read_event_handler not found: %V", id);
370
                        "upload-progress: read_event_handler not found: %V", id);
345
     }
371
     }
346
     ngx_shmtx_unlock(&shpool->mutex);
372
     ngx_shmtx_unlock(&shpool->mutex);
373
+    ngx_http_uploadprogress_strdupfree(id);
347
 }
374
 }
348
 
375
 
349
 /* This generates the response for the report */
376
 /* This generates the response for the report */

Loading…
İptal
Kaydet