Resolver: fixed possible use-after-free while resolving PTR. Previously, if a response to the PTR request was cached, and ngx_resolver_dup() failed to allocate memory for the resulting name, then the original node was freed but left in expire_queue. A subsequent address resolving would end up in a use-after-free memory access of the node either in ngx_resolver_expire() or ngx_resolver_process_ptr(), when accessing it through expire_queue. The fix is to leave the resolver node intact.
diff --git a/src/core/ngx_resolver.c b/src/core/ngx_resolver.c index 593645d..e51712c 100644 --- a/src/core/ngx_resolver.c +++ b/src/core/ngx_resolver.c
@@ -972,7 +972,8 @@ name = ngx_resolver_dup(r, rn->name, rn->nlen); if (name == NULL) { - goto failed; + ngx_resolver_free(r, ctx); + return NGX_ERROR; } ctx->name.len = rn->nlen;