tree e19ef9197dcd6099996141975535bae02f17801d
parent 86c5513ecb34ab90027935c329e74b41fdc3a49e
author Maxim Dounin <mdounin@mdounin.ru> 1329910133 +0000
committer Maxim Dounin <mdounin@mdounin.ru> 1329910133 +0000

Event pipe: fixed buffer loss in p->length case.

With previous code raw buffer might be lost if p->input_filter() was called
on a buffer without any data and used ngx_event_pipe_add_free_buf() to
return it to the free list.  This eventually might cause "all buffers busy"
problem, resulting in segmentation fault due to null pointer dereference in
ngx_event_pipe_write_chain_to_temp_file().

In ngx_event_pipe_add_free_buf() the buffer was added to the list start
due to pos == last, and then "p->free_raw_bufs = cl->next" in
ngx_event_pipe_read_upstream() dropped both chain links to the buffer
from the p->free_raw_bufs list.

Fix is to move "p->free_raw_bufs = cl->next" before calling the
p->input_filter().