mirror of
https://github.com/nginx/nginx.git
synced 2026-10-24 22:57:43 -05:00
HTTP/3: allocate insert buffer from connection pool
Previously, it was allocated from the encoder stream pool. This could lead to use-after-free if the stream was closed and another encoder stream was opened. Reported by Trung Nguyen (@everping) of CyStack.
This commit is contained in:
1 parent
875750a4f7
commit
ceccdbd2ee
1 file changed
+1
-1
@@ -168,7 +168,7 @@ ngx_http_v3_get_insert_buffer(ngx_connection_t *c)
|
||||
if (dt->insert_buffer == NULL) {
|
||||
h3scf = ngx_http_v3_get_module_srv_conf(c, ngx_http_v3_module);
|
||||
|
||||
dt->insert_buffer = ngx_create_temp_buf(c->pool,
|
||||
dt->insert_buffer = ngx_create_temp_buf(c->quic->parent->pool,
|
||||
h3scf->max_table_capacity);
|
||||
if (dt->insert_buffer == NULL) {
|
||||
return NULL;
|
||||
|
||||
Reference in new issue
Block a user