# Nginx 1.0.5 in windows heap corruption

**URL:** <https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942>\
**Category:** NGINX\
**Created:** [August 21, 2011, 6:07pm UTC](https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942 "2011-08-21T18:07:48Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [August 21, 2011, 6:07pm UTC](https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942/1 "2011-08-21T18:07:48Z")

</div>

Hi,  
When I use Nginx 1.0.5 in WINDOWS, It message a box with information  
that is heap corruption.  
I use Visual Studio to debug it and find that in  
src/os/win32/ngx\_file.c line 224 ngx\_win32\_rename\_file() .  
When I do like this:

ngx\_err\_t  
ngx\_win32\_rename\_file(ngx\_str\_t \*from, ngx\_str\_t \*to, ngx\_log\_t \*log)  
{  
u\_char \*name;  
ngx\_err\_t err;  
ngx\_uint\_t collision;  
ngx\_atomic\_uint\_t num;  
size\_t size;

```
size = to->len + 1 + 10 + 1 + sizeof("DELETE") + 1;

name = ngx_alloc(size, log);
if (name == NULL) {
    return NGX_ENOMEM;
}

ngx_memzero(name,size);

ngx_memcpy(name, to->data, to->len);

...

```

…  
}

It run OK…

Posted at Nginx Forum:

> **[Nginx 1.0.5 in windows heap corruption](https://forum.nginx.org/read.php?2,214106,214106#msg-214106)**
>
> Hi, When I use Nginx 1.0.5 in WINDOWS, It message a box with information that is heap corruption. I use Visual Studio to debug it and find that in src/os/win32/ngx\_file.c line 224 ngx\_win32\_rename\_file() . When I do like this: ngx\_err\_t ngx\_wi

---

<div class="post-metadata">

**Author:** ![hydra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/ccd318/32.png) [@hydra](https://www.ruby-forum.com/u/hydra)\
**Post date:** [August 21, 2011, 6:32pm UTC](https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942/2 "2011-08-21T18:32:32Z")

</div>

Hello!

On Sun, Aug 21, 2011 at 12:07:06PM -0400, hydra wrote:

> ```
> u_char *name;
> ngx_err_t err;
> ngx_uint_t collision;
> ngx_atomic_uint_t num;
> size_t size;
> 
> size = to->len + 1 + 10 + 1 + sizeof("DELETE") + 1;
> 
> ```

Thank you for report. It looks like “10” here should be  
instead NGX\_ATOMIC\_T\_LEN here.

Could you please test the following patch?

diff --git a/src/os/win32/ngx\_files.c b/src/os/win32/ngx\_files.c  
— a/src/os/win32/ngx\_files.c  
+++ b/src/os/win32/ngx\_files.c  
@@ -228,7 +228,8 @@ ngx\_win32\_rename\_file(ngx\_str\_t \*from, n  
ngx\_uint\_t collision;  
ngx\_atomic\_uint\_t num;

- name = ngx\_alloc(to-\>len + 1 + 10 + 1 + sizeof(“DELETE”), log);

- name = ngx\_alloc(to-\>len + 1 + NGX\_ATOMIC\_T\_LEN + 1 +  
sizeof(“DELETE”),
- 

```
                log);

```

if (name == NULL) {  
return NGX\_ENOMEM;  
}

Maxim D.

---

<div class="post-metadata">

**Author:** ![hydra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/ccd318/32.png) [@hydra](https://www.ruby-forum.com/u/hydra)\
**Post date:** [August 21, 2011, 6:55pm UTC](https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942/3 "2011-08-21T18:55:28Z")

</div>

On Sun, Aug 21, 2011 at 12:07:06PM -0400, hydra wrote:

> ```
> u_char *name;
> }
> 
> ngx_memzero(name,size);
> 
> ngx_memcpy(name, to->data, to->len);
> 
> ...
> 
> ```
> 
> …  
> }
> 
> It run OK..

ngx\_memzero() is useless here.  
Have you built in 64-bit mode ?

–  
Igor S.

---

<div class="post-metadata">

**Author:** ![hydra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/ccd318/32.png) [@hydra](https://www.ruby-forum.com/u/hydra)\
**Post date:** [August 21, 2011, 9:10pm UTC](https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942/4 "2011-08-21T21:10:06Z")

</div>

Hello!

On Sun, Aug 21, 2011 at 08:54:47PM +0400, Igor S. wrote:

[…]

> Have you built in 64-bit mode ?

I believe even on 32-bit %0muA will be 11 bytes long, which is a  
bit to many to fit into 10 bytes allocated.

Maxim D.

---

<div class="post-metadata">

**Author:** ![hydra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/ccd318/32.png) [@hydra](https://www.ruby-forum.com/u/hydra)\
**Post date:** [August 22, 2011, 3:58am UTC](https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942/5 "2011-08-22T03:58:45Z")

</div>

## Igor S. Wrote:

> > When I do like this:
> > 
> > ```
> > ngx_memcpy(name, to->data, to->len);
> > 
> > ```
> 
> –  
> Igor S.
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx)

Yes, I built in 64-bit mode.But I use Visual Studio 2008 32-bit.So…

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,214106,214121#msg-214121](http://forum.nginx.org/read.php?2,214106,214121#msg-214121)

---

<div class="post-metadata">

**Author:** ![hydra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/ccd318/32.png) [@hydra](https://www.ruby-forum.com/u/hydra)\
**Post date:** [August 22, 2011, 5:15am UTC](https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942/6 "2011-08-22T05:15:53Z")

</div>

On Sun, Aug 21, 2011 at 11:09:12PM +0400, Maxim D. wrote:

> Hello!
> 
> On Sun, Aug 21, 2011 at 08:54:47PM +0400, Igor S. wrote:
> 
> […]
> 
> > Have you built in 64-bit mode ?
> 
> I believe even on 32-bit %0muA will be 11 bytes long, which is a  
> bit to many to fit into 10 bytes allocated.

Yes, you are right, please commit this fix.

–  
Igor S.

---

<div class="post-metadata">

**Author:** ![hydra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/ccd318/32.png) [@hydra](https://www.ruby-forum.com/u/hydra)\
**Post date:** [August 22, 2011, 5:17am UTC](https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942/7 "2011-08-22T05:17:07Z")

</div>

On Sun, Aug 21, 2011 at 09:56:17PM -0400, hydra wrote:

> Hello, Maxim D.  
> I test your patch, it works very OK.The heap memory is emough to  
> save name string.
> 
> ```
> Hi,I want to ask a problem. In function that
> 
> ```
> 
> ngx\_win32\_rename\_file() ,there is a comment that /\* mutex\_lock() (per  
> cache or single ?) \*/.  
> Is it useless? I mean mutext\_lock is useless in  
> ngx\_win32\_rename\_file()?

Yes, it’s useless.

–  
Igor S.

---

<div class="post-metadata">

**Author:** ![hydra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/ccd318/32.png) [@hydra](https://www.ruby-forum.com/u/hydra)\
**Post date:** [August 22, 2011, 3:56am UTC](https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942/8 "2011-08-22T03:56:54Z")

</div>

Hello, Maxim D.  
I test your patch, it works very OK.The heap memory is emough to  
save name string.

```
Hi,I want to ask a problem. In function that

```

ngx\_win32\_rename\_file() ,there is a comment that /\* mutex\_lock() (per  
cache or single ?) \*/.  
Is it useless? I mean mutext\_lock is useless in  
ngx\_win32\_rename\_file()?

## Maxim D. Wrote:

> in
> 
> > ```
> > ngx_uint_t collision;
> > 
> > ```
> 
> Could you please test the following patch?
> 
> - name = ngx\_alloc(to-\>len + 1 + 10 + 1 +
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx)

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,214106,214120#msg-214120](http://forum.nginx.org/read.php?2,214106,214120#msg-214120)

---

<div class="post-metadata">

**Author:** ![hydra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/ccd318/32.png) [@hydra](https://www.ruby-forum.com/u/hydra)\
**Post date:** [August 23, 2011, 6:27am UTC](https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942/9 "2011-08-23T06:27:42Z")

</div>

## Maxim D. Wrote:

> Thanks for testing, the patch was committed and  
> will be included  
> in upcoming 1.1.1 release.
> 
> Maxim D.
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx)

I hope nginx will run OK in WINDOWS. And When can Nginx run in WINDOWS  
with IOCP?

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,214106,214157#msg-214157](http://forum.nginx.org/read.php?2,214106,214157#msg-214157)

---

<div class="post-metadata">

**Author:** ![hydra](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/ccd318/32.png) [@hydra](https://www.ruby-forum.com/u/hydra)\
**Post date:** [August 22, 2011, 12:13pm UTC](https://www.ruby-forum.com/t/nginx-1-0-5-in-windows-heap-corruption/210942/10 "2011-08-22T12:13:35Z")

</div>

Hello!

On Sun, Aug 21, 2011 at 09:56:17PM -0400, hydra wrote:

> Hello, Maxim D.  
> I test your patch, it works very OK.The heap memory is emough to  
> save name string.

Thanks for testing, the patch was committed and will be included  
in upcoming 1.1.1 release.

Maxim D.