Mercurial > hg > nginx
comparison src/http/v2/ngx_http_v2.c @ 6752:0708285115fa stable-1.10
HTTP/2: fixed a segfault while processing unbuffered upload.
The ngx_http_v2_finalize_connection() closes current stream, but that is an
invalid operation while processing unbuffered upload. This results in access
to already freed memory, since the upstream module sets a cleanup handler that
also finalizes the request.
| author | Valentin Bartenev <vbart@nginx.com> |
|---|---|
| date | Thu, 16 Jun 2016 20:55:11 +0300 |
| parents | 696dbfb0490a |
| children | dc5eaf998b96 |
comparison
equal
deleted
inserted
replaced
| 6751:696dbfb0490a | 6752:0708285115fa |
|---|---|
| 4167 (void) ngx_http_v2_send_output_queue(h2c); | 4167 (void) ngx_http_v2_send_output_queue(h2c); |
| 4168 } | 4168 } |
| 4169 | 4169 |
| 4170 c->error = 1; | 4170 c->error = 1; |
| 4171 | 4171 |
| 4172 if (h2c->state.stream) { | |
| 4173 ngx_http_v2_close_stream(h2c->state.stream, NGX_HTTP_BAD_REQUEST); | |
| 4174 } | |
| 4175 | |
| 4176 if (!h2c->processing) { | 4172 if (!h2c->processing) { |
| 4177 ngx_http_close_connection(c); | 4173 ngx_http_close_connection(c); |
| 4178 return; | 4174 return; |
| 4179 } | 4175 } |
| 4180 | 4176 |