From: Maxim Dounin <mdounin@mdounin.ru>
Date: Mon, 13 Feb 2012 15:33:08 +0000 (+0000)
Subject: Core: protection from subrequest loops.
X-Git-Tag: release-1.1.15~10
X-Git-Url: http://git.kaiwu.me/sitemap.xml?a=commitdiff_plain;h=1b0ad6ee72179fef479bfae7c8c4bfd5ac834c29;p=nginx.git

Core: protection from subrequest loops.

Without the protection, subrequest loop results in r->count overflow and
SIGSEGV.  Protection was broken in 0.7.25.

Note that this also limits number of parallel subrequests.  This
wasn't exactly the case before 0.7.25 as local subrequests were
completed directly.

See here for details:
http://nginx.org/pipermail/nginx-ru/2010-February/032184.html
---

diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index 251f932fd..24102e492 100644
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -2453,7 +2453,6 @@ ngx_http_subrequest(ngx_http_request_t *r,
     sr->start_sec = tp->sec;
     sr->start_msec = tp->msec;
 
-    r->main->subrequests++;
     r->main->count++;
 
     *psr = sr;
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index 2b3f0065b..c35d550a2 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -2010,6 +2010,7 @@ ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
         if (r == c->data) {
 
             r->main->count--;
+            r->main->subrequests++;
 
             if (!r->logged) {