Fix UAF in ngx_http_uploadprogress_event_handler

[BenBE]

This UAF can be reached when compiling with --with-debug.

Fixes #61

[masterzen]

LGTM, thanks!

[BenBE]

Thx for merging so quickly.

I had someone else (@martok) also take a look at this patch, and this seems to have been the only occurence of this in the file.

That ssid, I'd suggest to do a release with this fix, as this UAF could leak arbitrary information to logfiles, if the freed memory gets re-assigned/allocated between the free and the log output (race condition) by another thread. The chance for this is small, but depending on the information this may contain about anything that nginx has access to (security impact). The risk here is low, given this only affects debug builds AND has some races involved.

[masterzen]

Thx for merging so quickly.

I had someone else (@martok) also take a look at this patch, and this seems to have been the only occurence of this in the file.

That ssid, I'd suggest to do a release with this fix, as this UAF could leak arbitrary information to logfiles, if the freed memory gets re-assigned/allocated between the free and the log output (race condition) by another thread. The chance for this is small, but depending on the information this may contain about anything that nginx has access to (security impact). The risk here is low, given this only affects debug builds AND has some races involved.

I've just released a new version v0.9.4 with the fix.
Thanks for your help :)