]> git.kaiwu.me - nginx.git/commit
Limited the number of pending operations per request
authorVadim Zhestikov <v.zhestikov@f5.com>
Mon, 17 Aug 2026 16:19:46 +0000 (09:19 -0700)
committerSergey Kandaurov <pluknet@nginx.com>
Thu, 1 Oct 2026 17:18:52 +0000 (21:18 +0400)
commit6adfc05ece48f92446383ec1f145446848694698
tree21f2e9ba1c667967cd0cca4c3f8367aa7f6a28e7
parentadf76b2fea33b896105b7487f032d163b1683e97
Limited the number of pending operations per request

Each pending asynchronous operation holds a reference in
r->main->blocked, an 8-bit field, and the increments were not checked.
With 256 operations pending on a single request the counter wrapped to
zero, after which the request could be freed while those operations
still referenced its pool.  This is the same overflow that 4ec67cf86
addressed for r->main->count, and left unaddressed for r->main->blocked.

Operations beyond the limit are now performed synchronously where a
synchronous path exists, and refused otherwise, so that the counter
cannot overflow.

Reported by cyberlancer.
src/http/ngx_http_copy_filter_module.c
src/http/ngx_http_file_cache.c
src/http/ngx_http_request.h
src/http/ngx_http_upstream.c