details: http://hg.nginx.org/nginx/rev/52bd8cc17f34
branches:
changeset: 6805:52bd8cc17f34
user: Valentin Bartenev <vbart@nginx.com>
date: Mon Nov 28 19:19:21 2016 +0300
description:
HTTP/2: fixed saving preread buffer to temp file (ticket #1143).

Previously, a request body bigger than "client_body_buffer_size" wasn't written
into a temporary file if it has been pre-read entirely. The preread buffer
is freed after processing, thus subsequent use of it might result in sending
corrupted body or cause a segfault.

diffstat:

src/http/v2/ngx_http_v2.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)

diffs (13 lines):

diff -r 2c7a2d75938a -r 52bd8cc17f34 src/http/v2/ngx_http_v2.c
--- a/src/http/v2/ngx_http_v2.c Mon Nov 21 16:49:19 2016 +0300
+++ b/src/http/v2/ngx_http_v2.c Mon Nov 28 19:19:21 2016 +0300
@@ -3575,6 +3575,9 @@ ngx_http_v2_read_request_body(ngx_http_r
rb->buf = ngx_create_temp_buf(r->pool, (size_t) len);

} else {
+ /* enforce writing body to file */
+ r->request_body_in_file_only = 1;
+
rb->buf = ngx_calloc_buf(r->pool);

if (rb->buf != NULL) {

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel