commit 1b0ad6ee72179fef479bfae7c8c4bfd5ac834c29
author Maxim Dounin <mdounin@mdounin.ru> Mon Feb 13 15:33:08 2012 +0000
committer Maxim Dounin <mdounin@mdounin.ru> Mon Feb 13 15:33:08 2012 +0000
tree 41be3508441cf82c71a4a928c025def21786504f
parent 947fc03ca30e355fd562404f7e0b3ff0ec232c66

Core: protection from subrequest loops.

Without the protection, subrequest loop results in r->count overflow and
SIGSEGV.  Protection was broken in 0.7.25.

Note that this also limits number of parallel subrequests.  This
wasn't exactly the case before 0.7.25 as local subrequests were
completed directly.

See here for details:
http://nginx.org/pipermail/nginx-ru/2010-February/032184.html

src/http/ngx_http_core_module.c

diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index 251f932..24102e4 100644
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -2453,7 +2453,6 @@
     sr->start_sec = tp->sec;
     sr->start_msec = tp->msec;
 
-    r->main->subrequests++;
     r->main->count++;
 
     *psr = sr;

src/http/ngx_http_request.c

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 2b3f006..c35d550 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -2010,6 +2010,7 @@
         if (r == c->data) {
 
             r->main->count--;
+            r->main->subrequests++;
 
             if (!r->logged) {