# The potential bug incurred by "one\_addr"

**URL:** <https://www.ruby-forum.com/t/the-potential-bug-incurred-by-one-addr/229184>\
**Category:** NGINX\
**Created:** [December 16, 2010, 9:37am UTC](https://www.ruby-forum.com/t/the-potential-bug-incurred-by-one-addr/229184 "2010-12-16T09:37:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![speedfirst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e19adc/32.png) [@speedfirst](https://www.ruby-forum.com/u/speedfirst)\
**Post date:** [December 16, 2010, 9:37am UTC](https://www.ruby-forum.com/t/the-potential-bug-incurred-by-one-addr/229184/1 "2010-12-16T09:37:25Z")

</div>

In ngx\_inet.c, there is a code piece of function  
“ngx\_inet\_resolve\_host”. If I set u-\>one\_addr to 1， but unfortunately  
this hostname map to multiple IP addresses, such as

```auto
10.37.4.92 myhost
127.0.0.1 myhost
```

in /etc/hosts.

h-\>h\_addr\_list will be 2 entries before NULL. Each of them will be  
converted to human readable format and assigned to u-\>addrs[i].  
However, when one\_addr is set, u-\>addrs will be allocated ONLY ONE  
ngx\_addr\_t mem. In this way, a mem crash is inevitable.

I set one\_addr to 1 because I’m writing a custom module and want to  
connect another server. Sadly the server is also running on the local  
host with multiple IP in /etc/hosts. I want to connect the first IP  
match that host name (10.37.4.92) because that server require a  
non-lookback IP. I thought “one\_addr” means “fetch the first found IP”.  
But seems I was wrong.

Besides this, I insist alloc mem with “i”, but loop will h-\>h\_addr\_list  
is very dangerous. Report an error is more suitable rather than leave a  
time bomb.

Affected version: all versions!!!

----------------------------------------------related  
coe---------------------------------------------

```auto
...
if (u->one_addr == 0) {
            for (i = 0; h->h_addr_list[i] != NULL; i++) { /* void */ }

        } else {
            i = 1;
        }

        /* MP: ngx_shared_palloc() */

        u->addrs = ngx_pcalloc(pool, i * sizeof(ngx_addr_t));
        if (u->addrs == NULL) {
            return NGX_ERROR;
        }

        u->naddrs = i;

        for (i = 0; h->h_addr_list[i] != NULL; i++) {

            sin = ngx_pcalloc(pool, sizeof(struct sockaddr_in));
            if (sin == NULL) {
                return NGX_ERROR;
            }

            sin->sin_family = AF_INET;
            sin->sin_port = port;
            sin->sin_addr.s_addr = *(in_addr_t *) (h->h_addr_list[ i
]);

            u->addrs[i].sockaddr = (struct sockaddr *) sin;
            u->addrs[i].socklen = sizeof(struct sockaddr_in);

            len = NGX_INET_ADDRSTRLEN + sizeof(":65535") - 1;

            p = ngx_pnalloc(pool, len);
            if (p == NULL) {
                return NGX_ERROR;
            }

            len = ngx_sock_ntop((struct sockaddr *) sin, p, len, 1);

            u->addrs[i].name.len = len;
            u->addrs[i].name.data = p;
        }
...
```

Posted at Nginx Forum:

> **[The potential bug incurred by "one\_addr".](https://forum.nginx.org/read.php?2,159051,159051#msg-159051)**
>
> In ngx\_inet.c, there is a code piece of function "ngx\_inet\_resolve\_host". If I set u-\>one\_addr to 1， but unfortunately this hostname map to multiple IP addresses, such as \[code\] 10.37.4.92 myhost 127.0.0.1 myhost \[/code\] in /etc/hosts.

---

<div class="post-metadata">

**Author:** ![speedfirst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e19adc/32.png) [@speedfirst](https://www.ruby-forum.com/u/speedfirst)\
**Post date:** [December 16, 2010, 2:28pm UTC](https://www.ruby-forum.com/t/the-potential-bug-incurred-by-one-addr/229184/2 "2010-12-16T14:28:06Z")

</div>

Hello!

On Thu, Dec 16, 2010 at 03:36:15AM -0500, speedfirst wrote:

> converted to human readable format and assigned to u-\>addrs[i].  
> However, when one\_addr is set, u-\>addrs will be allocated ONLY ONE  
> ngx\_addr\_t mem. In this way, a mem crash is inevitable.

Thank you for your report. This bug had appeared in 0.5.0 (where  
u-\>one\_addr flag was introduced) and affects auth\_http in mail  
module (the only place currently use it in nginx).

Attached patch fixes it.

Maxim D.