Fix node corruption bug while cleaning uploads

When we clean a node, we ask nginx to free the memory. On some
platform or no load there were great chance the memory wasn't
reused for something else.
With high load and on FreeBSD, the memory seems to be reused
immediatly and we jump in the middle of f*****g nowhere, and
we crash.

Thanks to Vladimir Getmanshchuk for his bug report.

Signed-off-by: Brice Figureau <brice@daysofwonder.com>

ngx_http_uploadprogress_module.c

@@ -798,7 +798,7 @@ ngx_clean_old_connections(ngx_event_t * ev)
     ngx_http_uploadprogress_ctx_t   *ctx;
     ngx_slab_pool_t                 *shpool;
     ngx_rbtree_node_t               *node;
-    ngx_http_uploadprogress_node_t  *up;
+    ngx_http_uploadprogress_node_t  *up, *upprev;
     time_t                           now = ngx_time();
     int                              count = 0;
 
@@ -821,6 +821,7 @@ ngx_clean_old_connections(ngx_event_t * ev)
         }
 
         up = (ngx_http_uploadprogress_node_t *) node;
+        upprev = up->prev;
 
         ngx_log_debug3(NGX_LOG_DEBUG_HTTP, shm_zone->shm.log, 0,
                        "uploadprogress clean: scanning %08XD (req done %ui) timeout at %T",
@@ -839,7 +840,7 @@ ngx_clean_old_connections(ngx_event_t * ev)
         }
         else
             count++;
-        node = (ngx_rbtree_node_t *) up->prev;
+        node = (ngx_rbtree_node_t *) upprev;
     }
 
     ngx_log_debug3(NGX_LOG_DEBUG_HTTP, shm_zone->shm.log, 0,