diff options
| author | Igor Sysoev <igor@sysoev.ru> | 2020-09-18 13:20:06 +0300 |
|---|---|---|
| committer | Igor Sysoev <igor@sysoev.ru> | 2020-09-18 13:20:06 +0300 |
| commit | 6b9882fc142cab4a15a272991096ef4db260bf0f (patch) | |
| tree | 3e99cd08a96a83701b30800939400cba70fd1030 | |
| parent | 6cfbf4ba791000705efeed4d29a212f6bd86821c (diff) | |
| download | unit-6b9882fc142cab4a15a272991096ef4db260bf0f.tar.gz unit-6b9882fc142cab4a15a272991096ef4db260bf0f.tar.bz2 | |
Fixed segmentation fault during reconfiguration.
If idle connection was closed before h1proto had been allocated
then c->socket.data is NULL. This happens if nxt_h1p_idle_response()
is called by nxt_h1p_idle_close(). However, h1p->conn_write_tail
is used only in nxt_h1p_request_send() that would not be called
after nxt_h1p_idle_response().
The bug was introduced in f237e8c553fd.
| -rw-r--r-- | src/nxt_h1proto.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/src/nxt_h1proto.c b/src/nxt_h1proto.c index 94b74929..17046187 100644 --- a/src/nxt_h1proto.c +++ b/src/nxt_h1proto.c @@ -1873,10 +1873,9 @@ nxt_h1p_idle_timeout(nxt_task_t *task, void *obj, void *data) static void nxt_h1p_idle_response(nxt_task_t *task, nxt_conn_t *c) { - u_char *p; - size_t size; - nxt_buf_t *out, *last; - nxt_h1proto_t *h1p; + u_char *p; + size_t size; + nxt_buf_t *out, *last; size = nxt_length(NXT_H1P_IDLE_TIMEOUT) + nxt_http_date_cache.size @@ -1906,9 +1905,6 @@ nxt_h1p_idle_response(nxt_task_t *task, nxt_conn_t *c) last->completion_handler = nxt_h1p_idle_response_sent; last->parent = c; - h1p = c->socket.data; - h1p->conn_write_tail = &last->next; - c->write = out; c->write_state = &nxt_h1p_timeout_response_state; |