Mercurial > hg > nginx
comparison src/http/v2/ngx_http_v2.c @ 6890:16487f9e6665 stable-1.10
HTTP/2: fixed saving preread buffer to temp file (ticket #1143).
Previously, a request body bigger than "client_body_buffer_size" wasn't written
into a temporary file if it has been pre-read entirely. The preread buffer
is freed after processing, thus subsequent use of it might result in sending
corrupted body or cause a segfault.
author | Valentin Bartenev <vbart@nginx.com> |
---|---|
date | Mon, 28 Nov 2016 19:19:21 +0300 |
parents | 09cf90250844 |
children | 749bcfdf097a |
comparison
equal
deleted
inserted
replaced
6889:09cf90250844 | 6890:16487f9e6665 |
---|---|
3558 && !r->request_body_in_file_only) | 3558 && !r->request_body_in_file_only) |
3559 { | 3559 { |
3560 rb->buf = ngx_create_temp_buf(r->pool, (size_t) len); | 3560 rb->buf = ngx_create_temp_buf(r->pool, (size_t) len); |
3561 | 3561 |
3562 } else { | 3562 } else { |
3563 /* enforce writing body to file */ | |
3564 r->request_body_in_file_only = 1; | |
3565 | |
3563 rb->buf = ngx_calloc_buf(r->pool); | 3566 rb->buf = ngx_calloc_buf(r->pool); |
3564 | 3567 |
3565 if (rb->buf != NULL) { | 3568 if (rb->buf != NULL) { |
3566 rb->buf->sync = 1; | 3569 rb->buf->sync = 1; |
3567 } | 3570 } |