IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-12-19 05:33:52 -06:00
Code Issues Packages Projects Releases Wiki Activity

HTTP/2: fixed socket leak with an incomplete HEADERS frame.

Browse Source 
A connection could get stuck without timers if a client has partially sent
the HEADERS frame such that it was split on the individual header boundary.
In this case, it cannot be processed without the rest of the HEADERS frame.

The fix is to call ngx_http_v2_state_headers_save() in this case.  Normally,
it would be called from the ngx_http_v2_state_header_block() handler on the
next iteration, when there is not enough data to continue processing.  This
isn't the case if recv_buffer became empty and there's no more data to read.
This commit is contained in:
Sergey Kandaurov 2020-02-05 16:29:23 +03:00
parent b7ea950a12
commit 16168dcb01
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/http/v2/ngx_http_v2.c
View File

@ -1719,8 +1719,13 @@ ngx_http_v2_state_header_complete(ngx_http_v2_connection_t *h2c, u_char *pos,
ngx_http_v2_stream_t *stream;
if (h2c->state.length) {
h2c->state.handler = ngx_http_v2_state_header_block;
return pos;
if (end - pos > 0) {
h2c->state.handler = ngx_http_v2_state_header_block;
return pos;
}
return ngx_http_v2_state_headers_save(h2c, pos, end,
ngx_http_v2_state_header_block);
}
if (!(h2c->state.flags & NGX_HTTP_V2_END_HEADERS_FLAG)) {