mirror of
https://github.com/nginx/nginx.git
synced 2025-02-25 18:55:26 -06:00
4cd1dd28dd
Previously, if a response to the PTR request was cached, and ngx_resolver_dup() failed to allocate memory for the resulting name, then the original node was freed but left in expire_queue. A subsequent address resolving would end up in a use-after-free memory access of the node either in ngx_resolver_expire() or ngx_resolver_process_ptr(), when accessing it through expire_queue. The fix is to leave the resolver node intact.