Fixing a crash after applying the wrong TLS configuration.

When an invalid TLS configuration is applied (such as the conf_commands
feature), nxt_cert_store_get() creates a buffer to send a certificate request
to the main process and adds its default completion handler to an asynchronous
queue to free the allocated buffer.  However, if configuration fails,
nxt_router_conf_error() removes the memory pool used to allocate the buffer,
causing a crash when the completion handler is dispatched.


Assertion "src/nxt_buf.c:208 assertion failed: data == b->parent" is triggered
when is NXT_DEBUG enabled in the configure script.


This patch uses a reference counter to retain the memory pool and redefines the
completion handler to free the buffer before releasing the memory pool.

1 files changed, 3 insertions, 3 deletions

diff --git a/src/nxt_router.c b/src/nxt_router.c
index da38aac0..2bbe87b8 100644
--- a/src/nxt_router.c
+++ b/src/nxt_router.c
@@ -773,7 +773,7 @@ fail:
                           msg->port_msg.stream, 0, NULL);
 
     if (tmcf != NULL) {
-        nxt_mp_destroy(tmcf->mem_pool);
+        nxt_mp_release(tmcf->mem_pool);
     }
 
 cleanup:
@@ -1061,7 +1061,7 @@ nxt_router_conf_ready(nxt_task_t *task, nxt_router_temp_conf_t *tmcf)
         nxt_mp_destroy(rtcf->mem_pool);
     }
 
-    nxt_mp_destroy(tmcf->mem_pool);
+    nxt_mp_release(tmcf->mem_pool);
 }
 
 
@@ -1120,7 +1120,7 @@ nxt_router_conf_error(nxt_task_t *task, nxt_router_temp_conf_t *tmcf)
 
     nxt_router_conf_send(task, tmcf, NXT_PORT_MSG_RPC_ERROR);
 
-    nxt_mp_destroy(tmcf->mem_pool);
+    nxt_mp_release(tmcf->mem_pool);
 }