commit 4e995cd5d77c364b51358cb600c708e05b73f96d
author Vladimir Homutov <vl@nginx.com> Wed Nov 07 13:22:14 2018 +0300
committer Vladimir Homutov <vl@nginx.com> Wed Nov 07 13:22:14 2018 +0300
tree 759577d471f312fb8e74785e286156eaf20cf545
parent 38f2afeaae689c892db345b8f5d23be410a13c7a

Stream: fixed possible use of a freed connection.

The session handler may result in session termination, thus a connection
pool (from which c->udp was allocated) may be destroyed.

src/event/ngx_event_udp.c

diff --git a/src/event/ngx_event_udp.c b/src/event/ngx_event_udp.c
index 8b0ae55..53b0904 100644
--- a/src/event/ngx_event_udp.c
+++ b/src/event/ngx_event_udp.c
@@ -261,7 +261,10 @@
 
             rev->handler(rev);
 
-            c->udp->buffer = NULL;
+            if (c->udp) {
+                c->udp->buffer = NULL;
+            }
+
             rev->ready = 0;
 
             goto next;
@@ -561,6 +564,8 @@
     ngx_connection_t  *c = data;
 
     ngx_rbtree_delete(&c->listening->rbtree, &c->udp->node);
+
+    c->udp = NULL;
 }