Postpone filter: prevented uninitialized r->out.
The r->out chain link could be left uninitialized in case of error.
A segfault could happen if the subrequest handler accessed it.
The issue was introduced in commit 20f139e9ffa8.
diff --git a/src/http/ngx_http_postpone_filter_module.c b/src/http/ngx_http_postpone_filter_module.c
index ded70b3..599d263 100644
--- a/src/http/ngx_http_postpone_filter_module.c
+++ b/src/http/ngx_http_postpone_filter_module.c
@@ -191,11 +191,6 @@
"http postpone filter in memory");
if (r->out == NULL) {
- r->out = ngx_alloc_chain_link(r->pool);
- if (r->out == NULL) {
- return NGX_ERROR;
- }
-
clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
if (r->headers_out.content_length_n != -1) {
@@ -218,6 +213,11 @@
b->last_buf = 1;
+ r->out = ngx_alloc_chain_link(r->pool);
+ if (r->out == NULL) {
+ return NGX_ERROR;
+ }
+
r->out->buf = b;
r->out->next = NULL;
}