tree db8f12c6c3f831fcfd3b1b8f219434f87090a3f1
parent bfbf8e61770e863ef74574a33c02e8e1bcfbf3bb
author Sergey Kandaurov <pluknet@nginx.com> 1568119354 +0300
committer Sergey Kandaurov <pluknet@nginx.com> 1568119354 +0300

Resolver: fixed possible use-after-free while resolving PTR.

Previously, if a response to the PTR request was cached, and ngx_resolver_dup()
failed to allocate memory for the resulting name, then the original node was
freed but left in expire_queue.  A subsequent address resolving would end up
in a use-after-free memory access of the node either in ngx_resolver_expire()
or ngx_resolver_process_ptr(), when accessing it through expire_queue.

The fix is to leave the resolver node intact.