Resolver: fixed possible use-after-free while resolving PTR.
Previously, if a response to the PTR request was cached, and ngx_resolver_dup()
failed to allocate memory for the resulting name, then the original node was
freed but left in expire_queue. A subsequent address resolving would end up
in a use-after-free memory access of the node either in ngx_resolver_expire()
or ngx_resolver_process_ptr(), when accessing it through expire_queue.
The fix is to leave the resolver node intact.
diff --git a/src/core/ngx_resolver.c b/src/core/ngx_resolver.c
index 593645d..e51712c 100644
--- a/src/core/ngx_resolver.c
+++ b/src/core/ngx_resolver.c
@@ -972,7 +972,8 @@
name = ngx_resolver_dup(r, rn->name, rn->nlen);
if (name == NULL) {
- goto failed;
+ ngx_resolver_free(r, ctx);
+ return NGX_ERROR;
}
ctx->name.len = rn->nlen;
