Hello!

On Wed, Aug 28, 2013 at 12:21:27AM +0800, lanshun zhou wrote:

> # HG changeset patch
> # User Lanshun Zhou <zls.sogou@gmail.com>
> # Date 1377620347 -28800
> # Node ID 4fae04f332b489c85cdc116e6138a618372d3691
> # Parent d1403de4163100ec0c6c015e57f22384456870e3
> Image filter: large image handling.
>
> If Content-Length header is not set, and the image size is larger than the
> buffer size, client will hang until a timeout occurs.
>
> Now NGX_HTTP_UNSUPPORTED_MEDIA_TYPE is returned immediately.
>
> diff -r d1403de41631 -r 4fae04f332b4
> src/http/modules/ngx_http_image_filter_module.c
> --- a/src/http/modules/ngx_http_image_filter_module.c Tue Aug 27 17:37:15
> 2013 +0400
> +++ b/src/http/modules/ngx_http_image_filter_module.c Wed Aug 28 00:19:07
> 2013 +0800
> @@ -478,7 +478,14 @@
> "image buf: %uz", size);
>
> rest = ctx->image + ctx->length - p;
> - size = (rest < size) ? rest : size;
> + if (rest < size) {
> + ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
> + "image filter: too big response: >%z, "
> + "try to increase image_filter_buffer",
> + ctx->length);
> +
> + return NGX_ERROR;
> + }

Good catch, thnx.

I don't think the message should be different from one emitted with
Content-Length available though. What about something like this:

--- a/src/http/modules/ngx_http_image_filter_module.c
+++ b/src/http/modules/ngx_http_image_filter_module.c
@@ -478,7 +478,12 @@ ngx_http_image_read(ngx_http_request_t
"image buf: %uz", size);

rest = ctx->image + ctx->length - p;
- size = (rest < size) ? rest : size;
+
+ if (size > rest) {
+ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+ "image filter: too big response");
+ return NGX_ERROR;
+ }

p = ngx_cpymem(p, b->pos, size);
b->pos += size;


?

--
Maxim Dounin
http://nginx.org/en/donation.html

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel