SPDY: fixed possible uninitialized memory access. The frame->stream pointer should always be initialized for control frames since the check against it can be performed in ngx_http_spdy_filter_cleanup().
diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c index e576196..01b8e28 100644 --- a/src/http/ngx_http_spdy.c +++ b/src/http/ngx_http_spdy.c
@@ -1633,8 +1633,8 @@ frame->first = cl; frame->last = cl; frame->handler = ngx_http_spdy_settings_frame_handler; -#if (NGX_DEBUG) frame->stream = NULL; +#if (NGX_DEBUG) frame->size = NGX_SPDY_FRAME_HEADER_SIZE + NGX_SPDY_SETTINGS_NUM_SIZE + NGX_SPDY_SETTINGS_PAIR_SIZE; @@ -1722,6 +1722,7 @@ frame->first = cl; frame->last = cl; frame->handler = ngx_http_spdy_ctl_frame_handler; + frame->stream = NULL; } frame->free = NULL; @@ -1733,7 +1734,6 @@ return NULL; } - frame->stream = NULL; frame->size = size; #endif