From 8c0f2cebf5eba555d104c42b556e54635f5d0890 Mon Sep 17 00:00:00 2001
From: Max Romanov <max.romanov@nginx.com>
Date: Mon, 3 Feb 2020 11:14:14 +0300
Subject: Storing pointer to next buffer in chain before free the buffer.

This is required to avoid dereference of freed memory.

Found by Coverity (CID 353372).
---
 src/nxt_buf_pool.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'src/nxt_buf_pool.c')

diff --git a/src/nxt_buf_pool.c b/src/nxt_buf_pool.c
index 8259c60a..f2be88a7 100644
--- a/src/nxt_buf_pool.c
+++ b/src/nxt_buf_pool.c
@@ -172,11 +172,12 @@ nxt_buf_pool_free(nxt_buf_pool_t *bp, nxt_buf_t *b)
 void
 nxt_buf_pool_destroy(nxt_buf_pool_t *bp)
 {
-    nxt_buf_t  *b;
+    nxt_buf_t  *b, *n;
 
     bp->destroy = 1;
 
-    for (b = bp->free; b != NULL; b = b->next) {
+    for (b = bp->free; b != NULL; b = n) {
+        n = b->next;
         nxt_buf_free(bp->mem_pool, b);
     }
 
-- 
cgit