IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-12-19 05:33:52 -06:00
Code Issues Packages Projects Releases Wiki Activity

HTTP/2: backed out 16905ecbb49e (ticket #822).

Browse Source 
It caused inconsistency between setting "in_closed" flag and the moment when
the last DATA frame was actually read.  As a result, the body buffer might not
be initialized properly in ngx_http_v2_init_request_body(), which led to a
segmentation fault in ngx_http_v2_state_read_data().  Also it might cause
start processing of incomplete body.

This issue could be triggered when the processing of a request was delayed,
e.g. in the limit_req or auth_request modules.
This commit is contained in:
Valentin Bartenev 2015-11-05 15:01:01 +03:00
parent f9cce38e49
commit b22c0e0846
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/http/v2/ngx_http_v2.c
View File

@ -870,8 +870,6 @@ ngx_http_v2_state_data(ngx_http_v2_connection_t *h2c, u_char *pos, u_char *end)
return ngx_http_v2_state_skip_padded(h2c, pos, end);
}
stream->in_closed = h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG;
h2c->state.stream = stream;
return ngx_http_v2_state_read_data(h2c, pos, end);
@ -899,6 +897,8 @@ ngx_http_v2_state_read_data(ngx_http_v2_connection_t *h2c, u_char *pos,
}
if (stream->skip_data) {
stream->in_closed = h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG;
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, h2c->connection->log, 0,
"skipping http2 DATA frame, reason: %d",
stream->skip_data);
@ -988,7 +988,9 @@ ngx_http_v2_state_read_data(ngx_http_v2_connection_t *h2c, u_char *pos,
ngx_http_v2_state_read_data);
}
if (stream->in_closed) {
if (h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG) {
stream->in_closed = 1;
if (r->headers_in.content_length_n < 0) {
r->headers_in.content_length_n = rb->rest;