[nginx] QUIC: ngx_quic_buffer_t use-after-free protection.

[Maxim Dounin]

details:   http://freenginx.org/hg/nginx/rev/5c6649b4308f
branches:  
changeset: 9284:5c6649b4308f
user:      Roman Arutyunyan <a...@nginx.com>
date:      Tue May 28 17:19:21 2024 +0400
description:
QUIC: ngx_quic_buffer_t use-after-free protection.

Previously the last chain field of ngx_quic_buffer_t could still reference freed
chains and buffers after calling ngx_quic_free_buffer().  While normally an
ngx_quic_buffer_t object should not be used after freeing, resetting last_chain
field would prevent a potential use-after-free.

diffstat:

 src/event/quic/ngx_event_quic_frames.c |  1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diffs (11 lines):

diff --git a/src/event/quic/ngx_event_quic_frames.c 
b/src/event/quic/ngx_event_quic_frames.c
--- a/src/event/quic/ngx_event_quic_frames.c
+++ b/src/event/quic/ngx_event_quic_frames.c
@@ -648,6 +648,7 @@ ngx_quic_free_buffer(ngx_connection_t *c
     ngx_quic_free_chain(c, qb->chain);
 
     qb->chain = NULL;
+    qb->last_chain = NULL;
 }