Autoindex: return NGX_ERROR on error if headers were sent. This prevents ngx_http_finalize_request() from issuing ngx_http_special_response_handler() on a freed context.
diff --git a/src/http/modules/ngx_http_autoindex_module.c b/src/http/modules/ngx_http_autoindex_module.c index e3dcfd0..e21d8d7 100644 --- a/src/http/modules/ngx_http_autoindex_module.c +++ b/src/http/modules/ngx_http_autoindex_module.c
@@ -388,7 +388,7 @@ b = ngx_create_temp_buf(r->pool, len); if (b == NULL) { - return NGX_HTTP_INTERNAL_SERVER_ERROR; + return NGX_ERROR; } if (entries.nelts > 1) { @@ -649,7 +649,7 @@ ngx_close_dir_n " \"%V\" failed", name); } - return NGX_HTTP_INTERNAL_SERVER_ERROR; + return r->header_sent ? NGX_ERROR : NGX_HTTP_INTERNAL_SERVER_ERROR; }