Valgrind error in nginx 1.5.9

[Maxim Dounin]

Hello!

On Wed, Mar 05, 2014 at 04:55:59PM -0800, Yichun Zhang (agentzh) wrote:

> Hello!
> 
> My EC2 test cluster caught a valgrind error in nginx 1.5.9 recently which
> I cannot easily reproduce by hand. Just FYI :)
> 
> ==28619== Invalid read of size 1
> ==28619== at 0x426B11: ngx_init_cycle (ngx_cycle.c:535)
> ==28619== by 0x437DA1: ngx_master_process_cycle (ngx_process_cycle.c:240)
> ==28619== by 0x419689: main (nginx.c:407)
> ==28619== Address 0x7f4bae9 is 23 bytes before a block of size 17 alloc'd
> ==28619== at 0x4C276FC: malloc (vg_replace_malloc.c:270)
> ==28619== by 0x433185: ngx_alloc (ngx_alloc.c:22)
> ==28619== by 0x41A980: ngx_malloc (ngx_palloc.c:124)
> ==28619== by 0x41A9D8: ngx_pnalloc (ngx_palloc.c:152)
> ==28619== by 0x426386: ngx_init_cycle (ngx_cycle.c:202)
> ==28619== by 0x437DA1: ngx_master_process_cycle (ngx_process_cycle.c:240)
> ==28619== by 0x419689: main (nginx.c:407)
> ==28619==

Thanks, looks like couple of typos in the code.

diff --git a/src/core/ngx_cycle.c b/src/core/ngx_cycle.c
--- a/src/core/ngx_cycle.c
+++ b/src/core/ngx_cycle.c
@@ -494,14 +494,14 @@ ngx_init_cycle(ngx_cycle_t *old_cycle)
                 }
 
                 if (ngx_cmp_sockaddr(nls[n].sockaddr, nls[n].socklen,
-                                     ls[i].sockaddr, ls[n].socklen, 1)
+                                     ls[i].sockaddr, ls[i].socklen, 1)
                     == NGX_OK)
                 {
                     nls[n].fd = ls[i].fd;
                     nls[n].previous = &ls[i];
                     ls[i].remain = 1;
 
-                    if (ls[n].backlog != nls[i].backlog) {
+                    if (ls[i].backlog != nls[n].backlog) {
                         nls[n].listen = 1;
                     }
 
@@ -532,7 +532,7 @@ ngx_init_cycle(ngx_cycle_t *old_cycle)
 
 #if (NGX_HAVE_DEFERRED_ACCEPT && defined TCP_DEFER_ACCEPT)
 
-                    if (ls[n].deferred_accept && !nls[n].deferred_accept) {
+                    if (ls[i].deferred_accept && !nls[n].deferred_accept) {
                         nls[n].delete_deferred = 1;
 
                     } else if (ls[i].deferred_accept != nls[n].deferred_accept)


-- 
Maxim Dounin
http://nginx.org/