HTTP: fixed r.subrequest() error handling. - Githubissues

nginx / njs

A subset of JavaScript language to use in nginx

http://nginx.org/en/docs/njs/

BSD 2-Clause "Simplified" License

1.14k stars 148 forks source link

HTTP: fixed r.subrequest() error handling. #735

Closed xeioex closed 3 months ago

xeioex commented 3 months ago

Previously, when at least 2 subrequests were scheduled they both succeed, but the callback for the second threw an exception heap-use-after-free happened.

The issue was introduced in 0.8.1 (4cb8e873e8c6).

Checklist

Before creating a PR, run through this checklist and mark each as complete:

[x] I have read the CONTRIBUTING document
[x] If applicable, I have added tests that prove my fix is effective or that my feature works
[x] If applicable, I have checked that any relevant tests pass after adding my changes

p-pautov commented 3 months ago

May be elaborate a bit on the reasons behind use-after-free? For example, "there was a nested chain of ngx_http_run_posted_requests() calls and terminating request in the inner call left outer calls with already freed request pointer".