mirror of
https://github.com/nginx/nginx.git
synced 2024-12-20 14:13:33 -06:00
Request body: fixed socket leak on errors.
The r->main->count reference counter was always incremented in ngx_http_read_client_request_body(), while it is only needs to be incremented on positive returns.
This commit is contained in:
parent
5da61375cd
commit
e1bd52041b
@ -31,6 +31,7 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
|
||||
{
|
||||
size_t preread;
|
||||
ssize_t size;
|
||||
ngx_int_t rc;
|
||||
ngx_buf_t *b;
|
||||
ngx_chain_t *cl, **next;
|
||||
ngx_http_request_body_t *rb;
|
||||
@ -44,12 +45,14 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
|
||||
}
|
||||
|
||||
if (ngx_http_test_expect(r) != NGX_OK) {
|
||||
return NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
goto done;
|
||||
}
|
||||
|
||||
rb = ngx_pcalloc(r->pool, sizeof(ngx_http_request_body_t));
|
||||
if (rb == NULL) {
|
||||
return NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
goto done;
|
||||
}
|
||||
|
||||
r->request_body = rb;
|
||||
@ -65,7 +68,8 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
|
||||
|
||||
if (r->request_body_in_file_only) {
|
||||
if (ngx_http_write_request_body(r, NULL) != NGX_OK) {
|
||||
return NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
goto done;
|
||||
}
|
||||
}
|
||||
|
||||
@ -95,7 +99,8 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
|
||||
|
||||
b = ngx_calloc_buf(r->pool);
|
||||
if (b == NULL) {
|
||||
return NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
goto done;
|
||||
}
|
||||
|
||||
b->temporary = 1;
|
||||
@ -106,7 +111,8 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
|
||||
|
||||
rb->bufs = ngx_alloc_chain_link(r->pool);
|
||||
if (rb->bufs == NULL) {
|
||||
return NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
goto done;
|
||||
}
|
||||
|
||||
rb->bufs->buf = b;
|
||||
@ -124,7 +130,8 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
|
||||
|
||||
if (r->request_body_in_file_only) {
|
||||
if (ngx_http_write_request_body(r, rb->bufs) != NGX_OK) {
|
||||
return NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
goto done;
|
||||
}
|
||||
}
|
||||
|
||||
@ -151,7 +158,8 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
|
||||
|
||||
r->read_event_handler = ngx_http_read_client_request_body_handler;
|
||||
|
||||
return ngx_http_do_read_client_request_body(r);
|
||||
rc = ngx_http_do_read_client_request_body(r);
|
||||
goto done;
|
||||
}
|
||||
|
||||
next = &rb->bufs->next;
|
||||
@ -181,12 +189,14 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
|
||||
|
||||
rb->buf = ngx_create_temp_buf(r->pool, size);
|
||||
if (rb->buf == NULL) {
|
||||
return NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
goto done;
|
||||
}
|
||||
|
||||
cl = ngx_alloc_chain_link(r->pool);
|
||||
if (cl == NULL) {
|
||||
return NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
|
||||
goto done;
|
||||
}
|
||||
|
||||
cl->buf = rb->buf;
|
||||
@ -211,7 +221,15 @@ ngx_http_read_client_request_body(ngx_http_request_t *r,
|
||||
|
||||
r->read_event_handler = ngx_http_read_client_request_body_handler;
|
||||
|
||||
return ngx_http_do_read_client_request_body(r);
|
||||
rc = ngx_http_do_read_client_request_body(r);
|
||||
|
||||
done:
|
||||
|
||||
if (rc >= NGX_HTTP_SPECIAL_RESPONSE) {
|
||||
r->main->count--;
|
||||
}
|
||||
|
||||
return rc;
|
||||
}
|
||||
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user