I think I've found a separate bug in ngx_http_subrequest:

ngx_http_core_module.c, line 2080 (in 0.8.33):
sr->headers_in = r->headers_in;

This results in a bitwise copy of headers_in from the parent request
to the subrequest. Inside headers_in is a list:
typedef struct {
ngx_list_t headers;
// ...
} ngx_http_headers_in_t;

When you do a bitwise copy of an ngx_list_t, you end up with a broken
list. Specifically, sr->headers_in->list->last in the subrequest
points to the last node in the r->headers_in.list.part chain in the
parent request. It should instead point to the last node in the
subrequest's sr->headers_in.list.part chain.

Thus if any module attempts to add more headers to the subrequest's
sr->headers_in, they actually will be added to the parent request's
r->headers_in instead.

I ran into this problem in a module that needs to add extra request
headers to a proxied subrequest.

-Brian

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://nginx.org/mailman/listinfo/nginx-devel