nginx 0.8.45-0.8.49 segfault bug

[zhijianpeng]

url may cause nginx work process crash
the code in src/http/ngx_http_request.c:ngx_http_free_request
[b]r->upstream may be a NULL pointer[/b]


#0  0x000000000042b368 in ngx_http_free_request (r=0x13b60c20, rc=0) at
src/http/ngx_http_request.c:2951
2951        switch (r->upstream->cache_status) {
(gdb) bt
#0  0x000000000042b368 in ngx_http_free_request (r=0x13b60c20, rc=0) at
src/http/ngx_http_request.c:2951
#1  0x000000000042b5d1 in ngx_http_close_request (r=, rc=0) at
src/http/ngx_http_request.c:2910
#2  0x000000000042de75 in ngx_http_finalize_connection (r=0x13b60c20) at
src/http/ngx_http_request.c:2145
#3  0x000000000042e4a1 in ngx_http_finalize_request (r=, rc=)
    at src/http/ngx_http_request.c:2045
#4  0x000000000042e12c in ngx_http_finalize_request (r=0x13b60c20,
rc=400) at src/http/ngx_http_request.c:1929
#5  0x000000000042f97e in ngx_http_process_request_line (rev=0x13b740a8)
at src/http/ngx_http_request.c:900
#6  0x0000000000421583 in ngx_epoll_process_events (cycle=0x13b56b90,
timer=, flags=)
    at src/event/modules/ngx_epoll_module.c:642
#7  0x0000000000419038 in ngx_process_events_and_timers
(cycle=0x13b56b90) at src/event/ngx_event.c:261
#8  0x000000000041ef50 in ngx_single_process_cycle (cycle=0x13b56b90) at
src/os/unix/ngx_process_cycle.c:306
#9  0x000000000040473b in main (argc=16, argv=0x13b560a0) at
src/core/nginx.c:393

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,125959,125959#msg-125959