Welcome! Log In Create A New Profile

Advanced

[nginx] Range filter: fixed loss of incoming chain links.

Maxim Dounin
May 13, 2019 05:22PM
details: https://hg.nginx.org/nginx/rev/ea05113adbdb
branches:
changeset: 7507:ea05113adbdb
user: Maxim Dounin <mdounin@mdounin.ru>
date: Mon May 13 22:44:02 2019 +0300
description:
Range filter: fixed loss of incoming chain links.

Filters are not allowed to change incoming chain links, and should allocate
their own links if any modifications are needed. Nevertheless
ngx_http_range_singlepart_body() modified incoming chain links in some
cases, notably at the end of the requested range.

No problems caused by this are currently known, mostly because of
limited number of possible modifications and the position of the range
body filter in the filter chain. Though this behaviour is clearly incorrect
and tests demonstrate that it can at least cause some proxy buffers being
lost when using proxy_force_ranges, leading to less effective handling
of responses.

Fix is to always allocate new chain links in ngx_http_range_singlepart_body().
Links are explicitly freed to ensure constant memory usage with long-lived
requests.

diffstat:

src/http/modules/ngx_http_range_filter_module.c | 54 ++++++++++++++++++++----
1 files changed, 45 insertions(+), 9 deletions(-)

diffs (88 lines):

diff --git a/src/http/modules/ngx_http_range_filter_module.c b/src/http/modules/ngx_http_range_filter_module.c
--- a/src/http/modules/ngx_http_range_filter_module.c
+++ b/src/http/modules/ngx_http_range_filter_module.c
@@ -700,8 +700,9 @@ ngx_http_range_singlepart_body(ngx_http_
ngx_http_range_filter_ctx_t *ctx, ngx_chain_t *in)
{
off_t start, last;
+ ngx_int_t rc;
ngx_buf_t *buf;
- ngx_chain_t *out, *cl, **ll;
+ ngx_chain_t *out, *cl, *tl, **ll;
ngx_http_range_t *range;

out = NULL;
@@ -721,8 +722,18 @@ ngx_http_range_singlepart_body(ngx_http_
"http range body buf: %O-%O", start, last);

if (ngx_buf_special(buf)) {
- *ll = cl;
- ll = &cl->next;
+
+ tl = ngx_alloc_chain_link(r->pool);
+ if (tl == NULL) {
+ return NGX_ERROR;
+ }
+
+ tl->buf = buf;
+ tl->next = NULL;
+
+ *ll = tl;
+ ll = &tl->next;
+
continue;
}

@@ -764,21 +775,46 @@ ngx_http_range_singlepart_body(ngx_http_

buf->last_buf = (r == r->main) ? 1 : 0;
buf->last_in_chain = 1;
- *ll = cl;
- cl->next = NULL;
+
+ tl = ngx_alloc_chain_link(r->pool);
+ if (tl == NULL) {
+ return NGX_ERROR;
+ }

- break;
+ tl->buf = buf;
+ tl->next = NULL;
+
+ *ll = tl;
+ ll = &tl->next;
+
+ continue;
}

- *ll = cl;
- ll = &cl->next;
+ tl = ngx_alloc_chain_link(r->pool);
+ if (tl == NULL) {
+ return NGX_ERROR;
+ }
+
+ tl->buf = buf;
+ tl->next = NULL;
+
+ *ll = tl;
+ ll = &tl->next;
}

if (out == NULL) {
return NGX_OK;
}

- return ngx_http_next_body_filter(r, out);
+ rc = ngx_http_next_body_filter(r, out);
+
+ while (out) {
+ cl = out;
+ out = out->next;
+ ngx_free_chain(r->pool, cl);
+ }
+
+ return rc;
}


_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

[nginx] Range filter: fixed loss of incoming chain links.

Maxim Dounin 53 May 13, 2019 05:22PM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 84
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready