Skip to content

Commit 0ac2ab2

Browse files
bugfix: tctx.pool is double freed. (openresty#2049)
} else if (tctx.pool) { CID 251579 (#1 of 1): Use after free (USE_AFTER_FREE) 18. deref_arg: Calling ngx_destroy_pool dereferences freed pointer tctx.pool. 762 ngx_destroy_pool(tctx.pool); 763 } 764}
1 parent b6db2e7 commit 0ac2ab2

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

src/ngx_http_lua_timer.c

+2
Original file line numberDiff line numberDiff line change
@@ -565,6 +565,8 @@ ngx_http_lua_timer_handler(ngx_event_t *ev)
565565
c = ngx_http_lua_create_fake_connection(tctx.pool);
566566
if (c == NULL) {
567567
errmsg = "could not create fake connection";
568+
/* tctx.pool is free in ngx_http_lua_create_fake_connection */
569+
tctx.pool = NULL;
568570
goto failed;
569571
}
570572

0 commit comments

Comments
 (0)