From afb92a8127d30e7c4ff6387a9b9761924b134940 Mon Sep 17 00:00:00 2001 From: Valentin Bartenev Date: Fri, 28 Mar 2014 20:05:07 +0400 Subject: [PATCH] SPDY: fixed the DATA frame length handling in case of some errors. There are a few cases in ngx_http_spdy_state_read_data() related to error handling when ngx_http_spdy_state_skip() might be called with an inconsistent state between *pos and sc->length, that leads to violation of frame layout parsing and resuted in corruption of spdy connection. Based on a patch by Xiaochen Wang. --- src/http/ngx_http_spdy.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c index 9c80febaf..bada9c8f6 100644 --- a/src/http/ngx_http_spdy.c +++ b/src/http/ngx_http_spdy.c @@ -1528,7 +1528,6 @@ ngx_http_spdy_state_read_data(ngx_http_spdy_connection_t *sc, u_char *pos, complete = 1; } else { - sc->length -= size; complete = 0; } @@ -1571,6 +1570,8 @@ ngx_http_spdy_state_read_data(ngx_http_spdy_connection_t *sc, u_char *pos, } } + sc->length -= size; + if (tf) { buf->start = pos; buf->pos = pos;