From de3c7a825ee446fe4e0dc84df3d57bfebdf8c6f6 Mon Sep 17 00:00:00 2001 From: Valentin Bartenev Date: Wed, 26 Mar 2014 18:01:11 +0400 Subject: [PATCH] SPDY: better detect if headers block has wrong entries count. Previously, only one case was checked: if there's more data to parse in a r->header_in buffer, but the buffer can be filled to the end by the last parsed entry, so we also need to check that there's no more data to inflate. --- src/http/ngx_http_spdy.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c index 3231b4673..9c80febaf 100644 --- a/src/http/ngx_http_spdy.c +++ b/src/http/ngx_http_spdy.c @@ -1196,10 +1196,10 @@ ngx_http_spdy_state_headers(ngx_http_spdy_connection_t *sc, u_char *pos, } } - if (buf->pos != buf->last) { - /* TODO: improve error message */ - ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "end %ui %p %p", complete, buf->pos, buf->last); + if (buf->pos != buf->last || sc->zstream_in.avail_in) { + ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, + "client sent SYN_STREAM frame " + "with invalid HEADERS block"); ngx_http_spdy_close_stream(sc->stream, NGX_HTTP_BAD_REQUEST); return ngx_http_spdy_state_protocol_error(sc); }