diff options
| author | Max Romanov <max.romanov@nginx.com> | 2020-02-03 11:14:14 +0300 |
|---|---|---|
| committer | Max Romanov <max.romanov@nginx.com> | 2020-02-03 11:14:14 +0300 |
| commit | 8c0f2cebf5eba555d104c42b556e54635f5d0890 (patch) | |
| tree | 4ca6bf6af8b53c702c615863c004c3d0962504b7 | |
| parent | 51120e06e32502c75010644d8b63086221ea78f9 (diff) | |
| download | unit-8c0f2cebf5eba555d104c42b556e54635f5d0890.tar.gz unit-8c0f2cebf5eba555d104c42b556e54635f5d0890.tar.bz2 | |
Storing pointer to next buffer in chain before free the buffer.
This is required to avoid dereference of freed memory.
Found by Coverity (CID 353372).
| -rw-r--r-- | src/nxt_buf_pool.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/nxt_buf_pool.c b/src/nxt_buf_pool.c index 8259c60a..f2be88a7 100644 --- a/src/nxt_buf_pool.c +++ b/src/nxt_buf_pool.c @@ -172,11 +172,12 @@ nxt_buf_pool_free(nxt_buf_pool_t *bp, nxt_buf_t *b) void nxt_buf_pool_destroy(nxt_buf_pool_t *bp) { - nxt_buf_t *b; + nxt_buf_t *b, *n; bp->destroy = 1; - for (b = bp->free; b != NULL; b = b->next) { + for (b = bp->free; b != NULL; b = n) { + n = b->next; nxt_buf_free(bp->mem_pool, b); } |