# HG changeset patch
# User Valentin Bartenev <vbart@nginx.com>
# Date 1395842471 -14400
# Node ID 2411d4b5be2ca690a5a00a1d8ad96ff69a00317f
# Parent  372cc6e532a6d70f66be64e31f8a73d19ca1889c
SPDY: better detect if headers block has wrong entries count.

Previously, only one case was checked: if there's more data to parse
in a r->header_in buffer, but the buffer can be filled to the end by
the last parsed entry, so we also need to check that there's no more
data to inflate.

diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -1196,10 +1196,10 @@ ngx_http_spdy_state_headers(ngx_http_spd
         }
     }
 
-    if (buf->pos != buf->last) {
-        /* TODO: improve error message */
-        ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
-                       "end %ui %p %p", complete, buf->pos, buf->last);
+    if (buf->pos != buf->last || sc->zstream_in.avail_in) {
+        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
+                      "client sent SYN_STREAM frame "
+                      "with invalid HEADERS block");
         ngx_http_spdy_close_stream(sc->stream, NGX_HTTP_BAD_REQUEST);
         return ngx_http_spdy_state_protocol_error(sc);
     }