hi


On Thu, Mar 27, 2014 at 1:01 AM, Valentin V. Bartenev <vbart@nginx.com>wrote:

> On Wednesday 26 March 2014 12:30:11 Xiaochen Wang wrote:
> > In our production, sometimes, the disk was full. In which case, the
> requests
> > after the POST request were handled wrongly in one spdy connection.
> >
> > Because the input body (DATA frame) of POST request could not be written
> to disk,
> > then ngx_http_spdy_state_read_data() tried to skip this DATA frame with
> wrong
> > sc->length, which broke spdy stream.
> >
> [..]
>
> While I agree that there's a problem with sc->length premature adjustment,
> but
> please note that the problem cannot be triggered by the way you described.
>
> The "pos" pointer is adjusted as well right before
> ngx_write_chain_to_temp_file()
> is called.
>

Yes, the pos pointer is right. But sc->length is not adjusted if it
receives a complete DATA frame.
Then ngx_http_spdy_state_skip() skips more data.

ngx_http_spdy_state_read_data
{
....
if (size >= sc->length) {
size = sc->length; <<< sc->length is not adjusted.
complete = 1;

} else {
sc->length -= size;
complete = 0;
}
....
}


>
> wbr, Valentin V. Bartenev
>
> _______________________________________________
> nginx-devel mailing list
> nginx-devel@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx-devel
>
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel