# HG changeset patch
# User Maxim Dounin <mdounin@mdounin.ru>
# Date 1677070356 -10800
# Wed Feb 22 15:52:36 2023 +0300
# Node ID 61bd779a868c4021c232dddfe7abda7e8ad32575
# Parent cffaf3f2eec8fd33605c2a37814f5ffc30371989
HTTP/2: socket leak with "return 444" in error_page (ticket #2455).

Similarly to ticket #274 (7354:1812f1d79d84), early request finalization
without calling ngx_http_run_posted_requests() resulted in a connection
hang (a socket leak) if the 400 (Bad Request) error was generated in
ngx_http_v2_state_process_header() due to invalid request headers and
"return 444" was used in error_page 400.

diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
--- a/src/http/v2/ngx_http_v2.c
+++ b/src/http/v2/ngx_http_v2.c
@@ -1730,6 +1730,7 @@ ngx_http_v2_state_process_header(ngx_htt
size_t len;
ngx_int_t rc;
ngx_table_elt_t *h;
+ ngx_connection_t *fc;
ngx_http_header_t *hh;
ngx_http_request_t *r;
ngx_http_v2_header_t *header;
@@ -1789,6 +1790,7 @@ ngx_http_v2_state_process_header(ngx_htt
}

r = h2c->state.stream->request;
+ fc = r->connection;

/* TODO Optimization: validate headers while parsing. */
if (ngx_http_v2_validate_header(r, header) != NGX_OK) {
@@ -1886,6 +1888,8 @@ error:

h2c->state.stream = NULL;

+ ngx_http_run_posted_requests(fc);
+
return ngx_http_v2_state_header_complete(h2c, pos, end);
}

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
https://mailman.nginx.org/mailman/listinfo/nginx-devel