comparison src/http/v2/ngx_http_v2.c @ 6890:16487f9e6665 stable-1.10

HTTP/2: fixed saving preread buffer to temp file (ticket #1143). Previously, a request body bigger than "client_body_buffer_size" wasn't written into a temporary file if it has been pre-read entirely. The preread buffer is freed after processing, thus subsequent use of it might result in sending corrupted body or cause a segfault.
author Valentin Bartenev <vbart@nginx.com>
date Mon, 28 Nov 2016 19:19:21 +0300
parents 09cf90250844
children 749bcfdf097a
comparison
equal deleted inserted replaced
6889:09cf90250844 6890:16487f9e6665
3558 && !r->request_body_in_file_only) 3558 && !r->request_body_in_file_only)
3559 { 3559 {
3560 rb->buf = ngx_create_temp_buf(r->pool, (size_t) len); 3560 rb->buf = ngx_create_temp_buf(r->pool, (size_t) len);
3561 3561
3562 } else { 3562 } else {
3563 /* enforce writing body to file */
3564 r->request_body_in_file_only = 1;
3565
3563 rb->buf = ngx_calloc_buf(r->pool); 3566 rb->buf = ngx_calloc_buf(r->pool);
3564 3567
3565 if (rb->buf != NULL) { 3568 if (rb->buf != NULL) {
3566 rb->buf->sync = 1; 3569 rb->buf->sync = 1;
3567 } 3570 }