details: http://hg.nginx.org/nginx/rev/2411d4b5be2c
branches:
changeset: 5626:2411d4b5be2c
user: Valentin Bartenev <vbart@nginx.com>
date: Wed Mar 26 18:01:11 2014 +0400
description:
SPDY: better detect if headers block has wrong entries count.

Previously, only one case was checked: if there's more data to parse
in a r->header_in buffer, but the buffer can be filled to the end by
the last parsed entry, so we also need to check that there's no more
data to inflate.

diffstat:

src/http/ngx_http_spdy.c | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)

diffs (18 lines):

diff -r 372cc6e532a6 -r 2411d4b5be2c src/http/ngx_http_spdy.c
--- a/src/http/ngx_http_spdy.c Wed Mar 26 17:43:39 2014 +0400
+++ b/src/http/ngx_http_spdy.c Wed Mar 26 18:01:11 2014 +0400
@@ -1196,10 +1196,10 @@ ngx_http_spdy_state_headers(ngx_http_spd
}
}

- if (buf->pos != buf->last) {
- /* TODO: improve error message */
- ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
- "end %ui %p %p", complete, buf->pos, buf->last);
+ if (buf->pos != buf->last || sc->zstream_in.avail_in) {
+ ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+ "client sent SYN_STREAM frame "
+ "with invalid HEADERS block");
ngx_http_spdy_close_stream(sc->stream, NGX_HTTP_BAD_REQUEST);
return ngx_http_spdy_state_protocol_error(sc);
}

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel