An official read-only mirror of http://hg.nginx.org/nginx/ which is updated hourly. Pull requests on GitHub cannot be accepted and will be automatically closed. The proper way to submit changes to nginx is via the nginx development mailing list, see http://nginx.org/en/docs/contributing_changes.html
Go to file
Sergey Kandaurov 77c01f10a1 Detect runaway chunks in ngx_http_parse_chunked().
As defined in HTTP/1.1, body chunks have the following ABNF:

   chunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF

where chunk-data is a sequence of chunk-size octets.

With this change, chunk-data that doesn't end up with CRLF at chunk-size
offset will be treated as invalid, such as in the example provided below:

4
SEE-THIS-AND-
4
THAT
0
2019-09-03 17:26:56 +03:00
auto Unconditional compilation of the postpone filter. 2019-05-08 19:22:13 +03:00
conf MIME: added font/woff2 type (ticket #1243). 2018-06-15 17:29:55 +03:00
contrib Contrib: vim syntax, update core and 3rd party module directives. 2019-06-30 10:39:01 +03:00
docs nginx-1.17.3-RELEASE 2019-08-13 15:45:56 +03:00
misc Updated OpenSSL used for win32 builds. 2019-06-25 04:47:43 +03:00
src Detect runaway chunks in ngx_http_parse_chunked(). 2019-09-03 17:26:56 +03:00
.hgtags release-1.17.3 tag 2019-08-13 15:45:57 +03:00